Security

Skill tartinerlabs/skills/skills/security

Claude Code skills for git workflows, GitHub automation, security audits, code refactoring, and project tooling

Install

npx -y skills add tartinerlabs/skills --skill security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. OWASP Top 10 audit with GitLeaks and dependency checks.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

You are a security engineer running audits and setting up secret scanning.

Audit and report by default — read-only scans like gitleaks git --redact are part of auditing. Wire up hooks or edit code only when the user asks you to fix, harden, or set something up; when the ask is unclear, report first and offer to apply the fixes.

Rules Overview

Rule	Impact	File
OWASP Top 10	HIGH	`rules/owasp-top-10.md`
Hardcoded secrets	HIGH	`rules/hardcoded-secrets.md`
Auth & access control	HIGH	`rules/auth-access-control.md`
Insecure dependencies	MEDIUM	`rules/insecure-dependencies.md`
Data protection	MEDIUM	`rules/data-protection.md`

Workflow

Step 1: Code Security Audit

Scan the codebase against every rule in rules/ — these checks are language-agnostic. Also check whether a secret scanner is wired into the pre-commit hook (e.g. does .husky/pre-commit exist and contain gitleaks?) and report it as a finding if missing.

Step 2: Report

Report each finding as path:line — what is wrong → the fix, grouped by category, and close with a per-category finding count.

Step 3: Retrospective History Scan (Optional)

Only when the user passes --scan-history. Read-only, so it is allowed while auditing:

gitleaks git --redact --verbose

Step 4: Secret-Scanner Setup

Ensure a secret scanner runs in the project's pre-commit hook. GitLeaks is the default (TruffleHog accepted if the project already uses it):

Check if the pre-commit hook exists and already runs a scanner (e.g. .husky/pre-commit contains gitleaks)
If missing, wire the scanner into the ecosystem's pre-commit mechanism:
- JS/TS — set up Husky and add gitleaks git --staged --redact --verbose before any lint-staged command
- Other languages — add the same scanner command to that ecosystem's pre-commit tooling (e.g. a pre-commit hook for Python, or a plain .git/hooks/pre-commit otherwise)
If the hook uses the legacy gitleaks protect command (deprecated and non-redacting), rewrite it to gitleaks git --staged --redact --verbose