Speckit.security

Skill wedabro/bro-skills/.agent/skills/speckit.security

Security Auditor - Audit application security using OWASP guidance, secret scanning, dependency analysis, and threat modeling.From its SKILL.md

Install

npx -y skills add wedabro/bro-skills --skill speckit.security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.0 KB, 442 tokens by cl100k_base, as published. Nobody here has run it

🎯 Mission

Ensuring full lifecycle security: auditing code according to OWASP, detecting secret leaks, scanning dependency vulnerabilities, threat modeling for sensitive features.

📥 Input

Codebase + .agent/specs/[feature]/spec.md
.agent/memory/constitution.md (§2 Security, §3 ENV)
Dependency manifest (package.json, requirements.txt...)

📋 Protocol

1. OWASP Top 10 Audit

Injection (SQLi/XSS/command), Broken AuthN/AuthZ, SSRF, IDOR.
Insecure deserialization, security misconfiguration.
Each finding: severity + location + suggested fix.

2. Secret & Config

Scan hard-coded secrets/keys/tokens in code + git history.
Verify ENV usage according to Constitution §3; .env does not commit.
Check .dockerignore , .gitignore block sensitive files.

3. Dependency & Supply Chain

Scan for CVE dependencies (npm audit / pip-audit / trivy).
Detected package typosquatting / unmaintained.
Pin version (DO NOT use open range for sensitive devices).

4. AuthN / AuthZ

Verify all sensitive endpoints with authz check (anti-IDOR).
Token storage/expiry/rotation correct; rate limiting.

5. Threat Modeling (sensitive features)

Light STRIDE: lists assets, attack surface, mitigation.
Production hardening: non-root container, minimum port.

📤 Output

Security report: findings (severity), remediation, residual risk.
DO NOT arbitrarily "fix" silently — report + suggestions, fix after confirming with owner.

🚫 Guard Rails

DO NOT echo the secret value in the response (key name + location only).
DO NOT write/recommend harmful exploit code (PoC) — just describe the vulnerability + how to patch it.
DO NOT ignore serious finding even if it affects progress.
DO NOT send code/secret to third party endpoint.
Use the language configured by the project or requested by the user.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.