skill-security-auditor
Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on \"security audit\", \"vulnerability scan\", \"code review for security\", \"find secrets\", \"check for vulnerabilities\", \"OWASP\", \"CVE\", or questions about code security.
Profile →npx skills add eigent-ai/eigent --skill skill-security-auditor --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Auditor Guide ## Overview This guide covers security auditing workflows for source code, dependencies, and configurations. For detailed vulnerability patterns and detection rules, see references/vulnerability-patterns.md. For secrets detection patterns, see references/secrets-patterns.md. ## Quick Start Run the bundled scan script against a project directory: ```bash python scripts/scan_project.py /path/to/project ``` This performs a lightweight scan for common issues: hardcoded secrets, dangerous function calls, and insecure patterns. For deeper analysis, follow the workflows below. ### Testing the scripts ```bash python scripts/scan_project.py /path/to/some/project --format text python scripts/scan_secrets.py /path/to/some/project --format text ``` ## Audit Workflow ### 1. Reconnaissance Before auditing, understand the project: ```bash # Identify languages, frameworks, and entry points find . -type f -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.go" -o -name "*.java" | head -20 cat package.json pyproject.toml requirements.txt go.mod pom.xml 2>/dev/null ``` Key questions: - What frameworks are used? (Express, Django, Flask, Spring, etc.) - Where are the entry
- Overview
- Quick Start
- Testing the scripts
- Audit Workflow
- 1. Reconnaissance
- 2. Secrets Detection
- 3. Vulnerability Scanning
- 4. Dependency Audit
- 5. Configuration Review
- 6. Authentication and Authorization Review
- Report Format
- Next Steps
python scripts/scan_project.py /path/to/project python scripts/scan_project.py /path/to/some/project --format text python scripts/scan_secrets.py /path/to/some/project --format text Identify languages, frameworks, and entry points find . -type f -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.go" -o -name "*.java" | head -20 cat package.json pyproject.toml requirements.txt go.mod pom.xml 2>/dev/null python scripts/scan_secrets.py /path/to/project Python pip audit safety check -r requirements.txt
What does the skill-security-auditor skill do?
Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on \"security audit\", \"vulnerability scan\", \"code review for security\", \"find secrets\", \"check for vulnerabilities\", \"OWASP\", \"CVE\", or questions about code security.
How do I install it?
Run `npx skills add eigent-ai/eigent --skill skill-security-auditor --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From eigent-ai/eigent, a repository with 14,733 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.