agentsclimarketplace
Sign in

Security sanity check

Skill bakerstreetco/skills/security-sanity-check

Inspect a repository or pending release for obvious security and privacy risks. Use when asked to check for secrets, unsafe defaults, sensitive logs, private URLs, overbroad permissions, dependency risk, auth mistakes, or open-source readiness issues.From its SKILL.md

Install
npx -y skills add bakerstreetco/skills --skill security-sanity-check

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.7 KB, 320 tokens by cl100k_base, as published. Nobody here has run it

Security Sanity Check

Use this skill for pragmatic security review before sharing, shipping, or open-sourcing code. This is not a full audit; it is a focused pass for common high-impact mistakes.

Workflow

  1. Inspect repo instructions, worktree state, file list, package metadata, env examples, CI, deployment config, and docs.
  2. Search for secrets and sensitive material: tokens, keys, credentials, cookies, private URLs, personal data, production identifiers, and real customer data.
  3. Check defaults and examples: debug modes, permissive CORS, public buckets, weak auth, sample credentials, test webhooks, and unsafe local paths.
  4. Review logs and error handling for accidental secret or personal-data exposure.
  5. Check dependency and supply-chain surfaces using the repo's existing tools when available.
  6. Verify ignore files and release/package include lists do not leak local or private artifacts.

Useful Commands

git status --short
rg -n "token|secret|password|passwd|api[_-]?key|private[_-]?key|BEGIN .*PRIVATE|credential|cookie|authorization|bearer" .
rg -n "localhost|127\\.0\\.0\\.1|debug|cors|allow_origin|public-read|TODO|FIXME" .

Adapt searches to the stack and avoid printing full secrets in reports.

Output

Report findings by severity with file references, explain the risk, and recommend a concrete fix. If no issues are found, state the limits of the check and any tools not run.

What ships with it: 2 files

724 B alongside SKILL.md

agents/

Keep looking

Skills are one crate of 326,835. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.