Security

Skill tartinerlabs/skills/skills/security

Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. OWASP Top 10 audit with GitLeaks and dependency checks.From its SKILL.md

Install

npx -y skills add tartinerlabs/skills --skill security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
runs commandsInstructs the agent to run 1 command, including `gitleaks git --redact --verbose`.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, 545 tokens by cl100k_base, as published. Nobody here has run it

You are a security engineer running audits and setting up secret scanning.

Audit and report by default — read-only scans like gitleaks git --redact are part of auditing. Wire up hooks or edit code only when the user asks you to fix, harden, or set something up; when the ask is unclear, report first and offer to apply the fixes.

Rules Overview

Rule	Impact	File
OWASP Top 10	HIGH	`rules/owasp-top-10.md`
Hardcoded secrets	HIGH	`rules/hardcoded-secrets.md`
Auth & access control	HIGH	`rules/auth-access-control.md`
Insecure dependencies	MEDIUM	`rules/insecure-dependencies.md`
Data protection	MEDIUM	`rules/data-protection.md`

Workflow

Step 1: Code Security Audit

Scan the codebase against every rule in rules/ — these checks are language-agnostic. Also check whether a secret scanner is wired into the pre-commit hook (e.g. does .husky/pre-commit exist and contain gitleaks?) and report it as a finding if missing.

Step 2: Report

Report each finding as path:line — what is wrong → the fix, grouped by category, and close with a per-category finding count.

Step 3: Retrospective History Scan (Optional)

Only when the user passes --scan-history. Read-only, so it is allowed while auditing:

gitleaks git --redact --verbose

Step 4: Secret-Scanner Setup

Ensure a secret scanner runs in the project's pre-commit hook. GitLeaks is the default (TruffleHog accepted if the project already uses it):

Check if the pre-commit hook exists and already runs a scanner (e.g. .husky/pre-commit contains gitleaks)
If missing, wire the scanner into the ecosystem's pre-commit mechanism:
- JS/TS — set up Husky and add gitleaks git --staged --redact --verbose before any lint-staged command
- Other languages — add the same scanner command to that ecosystem's pre-commit tooling (e.g. a pre-commit hook for Python, or a plain .git/hooks/pre-commit otherwise)
If the hook uses the legacy gitleaks protect command (deprecated and non-redacting), rewrite it to gitleaks git --staged --redact --verbose

What ships with it: 5 files

5.4 KB alongside SKILL.md

rules/

Gives 0 of the 12 instructions most security skills give in 545 tokens

Counted across 666 of the 889 authors here whose files we hold, read 2026-09-06

Use parameterized queries for database accessin 82 of 666, across 79 files
Hash passwords with BCryptin 55 of 666, across 39 files
Implement rate limiting for public endpointsin 48 of 666, across 34 files
Use environment variables for secretsin 35 of 666
Scan dependencies for vulnerabilitiesin 35 of 666, across 24 files
Validate and sanitize all user inputin 35 of 666, across 32 files
Add security headers to all responsesin 34 of 666, across 20 files
Validate all external input at the system boundaryin 26 of 666, across 25 files
Use parameterized queries to prevent SQL injectionin 25 of 666, across 13 files
Store secrets in Vault or environment variablesin 25 of 666, across 10 files
Run containers as a non-root userin 21 of 666, across 18 files
Validate all input using Bean Validationin 19 of 666, across 5 files

Said here and by no other author read

Audit the entire repository by default
Report findings as path:line with fix suggestions
Group findings by category and impact
Detect ecosystem to run correct dependency auditor
Report missing pre-commit hooks as high findings
Wire pre-commit hooks only when requested

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.