agentsclimarketplace

Security audit skills applelamps security audit

Skill bg-szy/TOP-SKILLS/skills/marketplace/security-audit__skills-applelamps-security-audit

全球最大的 Claude Code 技能聚合库 · 收录 3900+ 来自 12+ 来源的技能，提供在线搜索与趋势分析看板 / The world's largest Claude Code skill aggregation hub — 3900+ skills from 12+ sources with online search and trend dashboard

Install
npx -y skills add bg-szy/TOP-SKILLS --skill security-audit__skills-applelamps-security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Review security of command execution, tool permissions, and API key handling. Use when user mentions "security review", "audit", "check security", "vulnerabilities", or before deploying to production.

SKILL.md

1.6 KB, 309 tokens by cl100k_base, as published. Nobody here has run it

Security Audit

Instructions

  1. Command Execution Review (backend/main.py):

    • Check run_terminal_command() for shell injection vulnerabilities
    • Verify timeout is enforced (should be 15 seconds)
    • Look for dangerous command patterns

  2. Tool Permission Review:

    • Verify Chat mode only allows: read_file, web_search
    • Check Agent mode tool restrictions
    • Look for permission bypass vulnerabilities

  3. Secrets Management:

    • Ensure .env is in .gitignore
    • Check no API keys are hardcoded
    • Verify python-dotenv usage for environment variables

  4. WebSocket Security:

    • Check for authentication on /ws endpoint
    • Review message validation
    • Look for injection points in user input

  5. Frontend Security:

    • Check for XSS in markdown rendering
    • Review image upload handling (base64 encoding)
    • Verify no sensitive data in client-side code

  6. Generate report with:

    • Critical issues (immediate action required)
    • Warnings (should fix before production)
    • Recommendations (best practices)

Examples

  • "Run a security audit"
  • "Check for vulnerabilities"
  • "Review security before deploy"

Guardrails

  • This is a READ-ONLY audit; do not modify files
  • Report findings without exploiting vulnerabilities
  • Recommend fixes but get user approval before implementing
  • Never log or expose discovered secrets

What ships with it: 1 file

14.6 KB alongside SKILL.md

Keep looking

Skills are one crate of 326,984. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.