Security Audit
Perform comprehensive security audits on codebases by scanning for OWASP Top 10 vulnerabilities, checking dependencies for known CVEs, detecting leaked secrets and API keys, and generating prioritized fix recommendations. This skill combines static analysis patterns with dependency auditing tools.
Overview
The Security Audit skill, hosted in the TerminalSkills/skills repository, provides automated security assessment capabilities for AI agents like Codex and Claude. It facilitates codebase reviews by identifying common security risks aligned with the OWASP Top 10 framework. The tool integrates static analysis patterns to detect vulnerabilities and scans project dependencies against databases of known CVEs. Additionally, it identifies exposed sensitive information such as API keys and secrets within the source code. Upon completion of an audit, the skill generates a list of prioritized recommendations to assist developers in remediating discovered issues. This utility is maintained within a repository that has garnered 72 stars, reflecting its utility for developers seeking to integrate security validation into their automated workflows.
Use Cases
Install Notes
# Review source first
open https://github.com/TerminalSkills/skills/blob/main/skills/security-audit/SKILL.mdCopy or clone the skill folder into your agent skills directory after reviewing its instructions and scripts.
Security Notes
This skill performs analysis of codebases and dependencies to identify potential vulnerabilities. Users should ensure the AI agent has appropriate read permissions for the target directory and be aware that automated scans may require manual verification to confirm findings and mitigate false positives.
Related Skills
Security And Hardening
addyosmani/agent-skills
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sess...
Mermaid To Proverif
trailofbits/skills
Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally verifying a protocol, converting a Mermaid diagram to ProVerif, verifying protocol security properties (secrecy, authentication, forward secrecy)...
Testing Handbook Generator
trailofbits/skills
Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the user names the testing handbook or appsec.guide. Not for an...
Semgrep
trailofbits/skills
Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for...
Audit Augmentation
trailofbits/skills
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings wi...
Diagramming Code
trailofbits/skills
Generates Mermaid diagrams from Trailmark code graphs. Produces call graphs, class hierarchies, module dependency maps, containment diagrams, complexity heatmaps, and attack surface data flow visualizations. Use when visualizing code architecture, drawing call graphs, generating class diagrams, creating dependency m...