Skill Security Auditor
Security auditing for code, configs, and infrastructure.
Install
npx skills add eigent-ai/eigent --skill skill-security-auditor -g -a claude-code -y- Repository
- eigent-ai/eigent15.7k
- Category
- Security
- Updated
- 3d ago
- License
- Complete terms in LICENSE.txt
- Context cost
- Mediumabout 1,640 tokens
- Runs scripts
- Yes, review before use
What it does
Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on \"security audit\", \"vulnerability scan\", \"code review for security\", \"find secrets\", \"check for vulnerabilities\", \"OWASP\", \"CVE\", or questions about code security.
Security Auditor Guide
Overview
This guide covers security auditing workflows for source code, dependencies, and configurations. For detailed vulnerability patterns and detection rules, see references/vulnerability-patterns.md. For secrets detection patterns, see references/secrets-patterns.md.
Quick Start
Run the bundled scan script against a project directory:
python scripts/scan_project.py /path/to/project
This performs a lightweight scan for common issues: hardcoded secrets, dangerous function calls, and insecure patterns. For deeper analysis, follow the workflows below.
Testing the scripts
python scripts/scan_project.py /path/to/some/project --format text
python scripts/scan_secrets.py /path/to/some/project --format text
Audit Workflow
1. Reconnaissance
Before auditing, understand the project:
# Identify languages, frameworks, and entry points
find . -type f -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.go" -o -name "*.java" | head -20
cat package.json pyproject.toml requirements.txt go.mod pom.xml 2>/dev/null
Key questions:
- What frameworks are used? (Express, Django, Flask, Spring, etc.)
- Where are the entry points? (routes, controllers, API handlers)
- How is authentication handled?
- What external services are called?
- Is user input accepted? Where?
2. Secrets Detection
Scan for hardcoded credentials, API keys, and tokens. See references/secrets-patterns.md for the full pattern list.
python scripts/scan_secrets.py /path/to/project
Common patterns to check:
- API keys and tokens in source files
- Database connection strings with embedded passwords
- Private keys or certificates committed to the repo
.envfiles or config files with plaintext secrets- Secrets in CI/CD configuration files
