Speckit.security
bro-skills - Spec-Driven Development CLI
npx -y skills add wedabro/bro-skills --skill speckit.securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Security Auditor - Audit application security using OWASP guidance, secret scanning, dependency analysis, and threat modeling.
SKILL.md
2.0 KB, 442 tokens by cl100k_base, as published. Nobody here has run it
🎯 Mission
Ensuring full lifecycle security: auditing code according to OWASP, detecting secret leaks, scanning dependency vulnerabilities, threat modeling for sensitive features.
📥 Input
- Codebase +
.agent/specs/[feature]/spec.md .agent/memory/constitution.md(§2 Security, §3 ENV)- Dependency manifest (package.json, requirements.txt...)
📋 Protocol
1. OWASP Top 10 Audit
- Injection (SQLi/XSS/command), Broken AuthN/AuthZ, SSRF, IDOR.
- Insecure deserialization, security misconfiguration.
- Each finding: severity + location + suggested fix.
2. Secret & Config
- Scan hard-coded secrets/keys/tokens in code + git history.
- Verify ENV usage according to Constitution §3;
.envdoes not commit. - Check
.dockerignore,.gitignoreblock sensitive files.
3. Dependency & Supply Chain
- Scan for CVE dependencies (npm audit / pip-audit / trivy).
- Detected package typosquatting / unmaintained.
- Pin version (DO NOT use open range for sensitive devices).
4. AuthN / AuthZ
- Verify all sensitive endpoints with authz check (anti-IDOR).
- Token storage/expiry/rotation correct; rate limiting.
5. Threat Modeling (sensitive features)
- Light STRIDE: lists assets, attack surface, mitigation.
- Production hardening: non-root container, minimum port.
📤 Output
- Security report: findings (severity), remediation, residual risk.
- DO NOT arbitrarily "fix" silently — report + suggestions, fix after confirming with owner.
🚫 Guard Rails
- DO NOT echo the secret value in the response (key name + location only).
- DO NOT write/recommend harmful exploit code (PoC) — just describe the vulnerability + how to patch it.
- DO NOT ignore serious finding even if it affects progress.
- DO NOT send code/secret to third party endpoint.
- Use the language configured by the project or requested by the user.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.
Gives 1 of the 12 instructions most audit compliance skills give in 442 tokens
Counted across 937 of the 1,487 authors here whose files we hold, read 2026-08-07
- Fetch latest guidelines before each reviewin 43 of 937, across 3 files
- Group findings by severityin 43 of 937
- Check files against all fetched rulesin 42 of 937, across 2 files
- Output findings in terse file:line formatin 41 of 937, across 3 files
- Ask user which files to review if none specifiedin 41 of 937, across 3 files
- Read specified files or prompt user for filesin 39 of 937, across 1 file
- Generate the audit reportin 33 of 937, across 30 files
- Assign a severity to every findinghere, and in 25 of 937
- Run automated accessibility scansin 23 of 937, across 13 files
- Output a markdown audit reportin 22 of 937
- Map findings to WCAG criteriain 20 of 937, across 10 files
- Confirm audit scopein 19 of 937, across 9 files
Said here and by no other author read
- Audit code for OWASP top ten vulnerabilities
- Verify environment variable usage and ignore files
- Pin dependency versions for sensitive devices
- Validate token storage, expiry, and rotation
- Produce a security report with findings and residual risk
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.