Sec audit

Skill vishnujchandran/.agents/skills/sec-audit

A curated collection of reusable AI agent skills, playbooks, and prompts for security audits, engineering workflows, and automation.

Install

npx -y skills add vishnujchandran/.agents --skill sec-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Production web application security audit skill for Next.js + Supabase stacks, with proof-based findings, prioritization, and CI-ready gate guidance.

SKILL.md

3.1 KB, 703 tokens by cl100k_base, as published. Nobody here has run it

sec-audit (v2.0)

Security copilot for modern web apps (Next.js + Supabase + Vercel oriented).

Trigger Signals

Use when user asks to:

review web app security posture
fix vulnerabilities before release
harden auth/API/webhook security
validate Supabase Auth/RLS/Storage controls

Inputs

scope (changed-files, module, full-repo)
deployment target (dev, stage, prod)
optional risk tolerance (strict, balanced)

Stack Profile

Next.js 16+ (App Router)
Supabase (Postgres/Auth/Storage)
Zod validation patterns
Vercel runtime/deploy model

Workflow

1) Fast Scan (if scanner exists)

Try in order:

node ~/.agents/skills/sec-audit/tools/webapp-sec-scan.js --path . --format all --out ./security-report --fail-on high
node ./.agents/skills/sec-audit/tools/webapp-sec-scan.js --path . --format all --out ./security-report --fail-on high
node ./examples/sec-audit/bin/webapp-sec-scan.js --path . --format all --out ./security-report --fail-on high

2) Manual Deep Review

NEXT_PUBLIC_* leakage and client-side secret exposure
Supabase service-role misuse and key boundary breaks
Missing auth/ownership checks on mutations (IDOR/BOLA style)
Missing strict Zod validation on input paths
XSS/injection/SSRF/open redirect risks
Webhook signature + replay protection gaps
Supabase RLS/policy correctness and bypass risks
Storage bucket exposure/overwrite/public link risks
Security headers, CORS, and error leakage posture

3) Verification

Re-check patched paths
Confirm no sensitive data in logs/errors
Validate authz and policy assumptions with test cases/checklists

Severity Model

Critical: auth bypass, service-role exposure, RLS bypass, unsigned webhook acceptance
High: exploitable IDOR/BOLA, missing authz on sensitive actions, replayable webhooks
Medium: weak validation, broad CORS, verbose errors, partial hardening gaps
Low: non-critical hygiene issues

Output Contract

Return exactly:

Executive summary
Findings table (severity | confidence | file | issue | impact | fix)
Evidence appendix (sanitized proof for critical/high)
Priority plan (P0/P1/P2)
Minimal-diff patch plan
CI gate recommendation (pass/fail + rationale)

Fail Conditions

Mark as not-release-ready if:

any unresolved Critical exists
unresolved High findings on auth/authz/data-protection paths
missing verification for patched high-risk issues

Templates

Use:

templates/finding-template.md
templates/ci-gate-template.md

Behavior Constraints

Never exfiltrate code, credentials, or secrets
Never provide destructive exploit instructions
Never auto-delete files
Prefer least privilege and secure defaults
Do not apply destructive changes without confirmation

Fallback

If scanner is missing, perform full manual review using same output contract and provide install-ready scanner instructions.