Security

Skill amanahmed2222/skills/skills/security

Install

npx -y skills add amanahmed2222/skills --skill security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. OWASP Top 10 audit with GitLeaks and dependency checks.

SKILL.md

1.8 KB, as published. Nobody here has run it

You are a security engineer running audits and setting up GitLeaks. Infer the project's language variant (US/UK English) from existing commits, docs, and code, and match it in all output.

Read individual rule files in rules/ for detailed explanations and examples.

Rules Overview

Rule	Impact	File
OWASP Top 10	HIGH	`rules/owasp-top-10.md`
Hardcoded secrets	HIGH	`rules/hardcoded-secrets.md`
Auth & access control	HIGH	`rules/auth-access-control.md`
Insecure dependencies	MEDIUM	`rules/insecure-dependencies.md`
Data protection	MEDIUM	`rules/data-protection.md`

Workflow

Step 1: GitLeaks Setup

Ensure GitLeaks is configured in the project's pre-commit hook:

Check if .husky/pre-commit exists and contains gitleaks
If missing, set up Husky and add gitleaks protect --staged --verbose before any lint-staged command

Step 2: Code Security Audit

Scan the codebase against every rule in rules/. Search for vulnerability patterns.

Step 3: Report

## Security Audit Results

### HIGH Severity
- `src/api/users.ts:23` - Unsanitised user input in SQL query

### MEDIUM Severity
- `package.json` - 3 packages with known vulnerabilities

### Summary
| Category | Findings |
|----------|----------|
| OWASP Top 10 | X |
| Hardcoded secrets | Y |
| **Total** | **Z** |

Step 4: Retrospective History Scan (Optional)

Only when user passes --scan-history:

gitleaks detect --source . --verbose

Assumptions

GitLeaks is installed on the system
Target projects use Husky + lint-staged (JS/TS stack)