agentsclimarketplace

Security auditor

Skill AtulPurohit/Antigravity-Awesome-Skills/skills/security-auditor

Installable GitHub library of 300+ professional agentic skills for Claude Code, Antigravity IDE, Gemini CLI, Cursor, and Copilot. Features a custom NPX installer, 9 stack-specific bundles, validation schemas, security auditing, and an interactive catalog explorer app.

Install
npx -y skills add AtulPurohit/Antigravity-Awesome-Skills --skill security-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

3 things to look at

  • 29 days oldThe repository was created 29 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Perform comprehensive security audits of applications and APIs. Produces CVSS-scored vulnerability reports with detailed remediation steps.

SKILL.md

3.3 KB, 719 tokens by cl100k_base, as published. Nobody here has run it

Security Auditor

Purpose

Systematically identify and document security vulnerabilities with clear severity ratings and remediation guidance.

⚠️ IMPORTANT: Only perform security testing on systems you have explicit written authorization to test.

Audit Framework

1️⃣ OWASP Top 10 (2021)

A01: Broken Access Control
  - IDOR (access user B's data as user A)
  - Missing authorization on admin endpoints
  - CORS misconfiguration

A02: Cryptographic Failures
  - HTTP instead of HTTPS
  - Weak cipher suites (RC4, MD5)
  - Passwords stored as plain text or MD5
  - Sensitive data in URL params/logs

A03: Injection
  - SQL injection
  - Command injection
  - LDAP injection
  - Template injection

A04: Insecure Design
  - Missing rate limiting
  - Business logic bypasses
  - Missing input validation

A05: Security Misconfiguration
  - Default credentials
  - Exposed debug endpoints
  - Verbose error messages
  - Unnecessary services running

A06: Vulnerable Components
  - npm/pip packages with known CVEs
  - Outdated frameworks
  - Unpatched dependencies

2️⃣ Automated Scanning Tools

# Dependency vulnerability scan
npm audit --audit-level=high
pip-audit
bundle audit

# SAST (Static analysis)
semgrep --config=auto ./src

# Secret scanning
truffleHog scan --disk .
git-secrets --scan

# Docker image scanning
docker scout cves my-image:latest

# DAST (Dynamic analysis)
nikto -h https://api.example.com
owasp-zap-scan https://api.example.com

3️⃣ Manual Testing Checklist

Authentication:
[ ] Brute force protection (lockout after N failures)
[ ] Secure password reset flow (time-limited tokens)
[ ] JWT algorithm confusion possible?
[ ] Session invalidation on logout

Authorization:
[ ] Every endpoint checks authorization
[ ] IDOR possible (access /orders/123 as different user)
[ ] Admin endpoints accessible to non-admins?

Input Validation:
[ ] SQL injection in all query parameters
[ ] XSS in all user-controlled display fields
[ ] File upload: MIME type, size, content validation
[ ] Path traversal in file operations

4️⃣ Vulnerability Report Format

## [CRITICAL] SQL Injection — POST /api/search

**CVSS Score:** 9.8 (Critical)
**CWE:** CWE-89

### Steps to Reproduce
1. POST /api/search with body: {"query": "test' OR '1'='1"}
2. Observe: Returns all records

### Impact
Full database read/write access as database user

### Evidence
Response includes records from other users

### Remediation
Use parameterized queries:
❌ db.query(`WHERE name = '${input}'`)
✅ db.query('WHERE name = ?', [input])

### References
- OWASP: https://owasp.org/www-community/attacks/SQL_Injection

Outputs

  1. Executive summary with risk rating
  2. Technical vulnerability report (CVSS scored)
  3. Prioritized remediation roadmap
  4. Verification test cases
  5. Security baseline recommendations

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 326,984. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.