agentsclimarketplace

Security baseline review

Skill stark-ai-de/agent-skills/incubator/skills/repo-maintenance/security-baseline-review

Public Agent Skills for Codex operations, Cursor operations, Claude operations, repo maintenance, skill maintenance, productivity, and engineering workflows.

Install
npx -y skills add stark-ai-de/agent-skills --skill security-baseline-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Review public repository security hygiene at a baseline maintainer level. Use when the user asks for secret-leak checks, SECURITY.md review, dependency hygiene, GitHub settings checklist, CI safety, or public release security readiness.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, 489 tokens by cl100k_base, as published. Nobody here has run it

Security Baseline Review

Goal

Review a public repository for baseline security hygiene without exploiting systems, exposing sensitive data, or overclaiming vulnerability status.

When to use

  • The user asks for a public repo security readiness check.
  • Secret hygiene, CI permissions, dependency policy, or SECURITY.md needs review.
  • A repository is about to be published.

When not to use

  • The user asks for exploit development or offensive instructions.
  • A full code vulnerability audit is required beyond maintainer hygiene.
  • Current CVE status is required but live advisory data is unavailable.

Inputs to inspect

  • .gitignore, .env.example, config samples, workflows, SECURITY.md, README, and contribution docs.
  • Dependency manifests, lockfiles, and update automation config.
  • Repository settings checklist when live GitHub access is authorized.

Review rubric

Check obvious secret patterns, sensitive examples, CI permissions, untrusted pull request behavior, dependency update policy, security reporting path, branch protection notes, and public/private boundary clarity. Read references/security-checklist.md for detail.

Workflow

  1. Inspect public-facing files and config examples.
  2. Search for obvious secret-like patterns without printing sensitive values.
  3. Review workflow permissions and risky shell patterns.
  4. Check dependency and security policy coverage.
  5. Recommend safer defaults and rotation if exposure is suspected.
  6. Separate confirmed issues from items requiring live repository settings.

Safety rules

  • Do not print suspected secret values.
  • Do not provide exploit instructions or proof-of-concept attack steps.
  • Recommend rotation before history cleanup when exposure is plausible.

References

Read only when needed:

  • references/security-checklist.md

Scripts

No bundled scripts.

Output format

Return:

  1. Baseline verdict
  2. Critical findings
  3. High-priority findings
  4. Medium or policy findings
  5. Settings to verify live
  6. Recommended next action

Failure modes

  • If a possible secret is found, do not quote it; identify the file and remediation.
  • If live settings cannot be checked, label them unverified.
  • If dependency advisories are needed, use current sources or say they were not checked.

Completion criteria

  • No sensitive value is disclosed in the report.
  • Findings are actionable and prioritized.
  • Public release blockers are clearly separated from hardening suggestions.

What ships with it: 1 file

646 B alongside SKILL.md

references/

Keep looking

Skills are one crate of 326,984. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.