# Skill Security Auditor

Security auditing for code, configs, and infrastructure.

- Repository: https://github.com/eigent-ai/eigent (15712 stars)
- Category: Security
- License: Complete terms in LICENSE.txt
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add eigent-ai/eigent --skill skill-security-auditor -g -a claude-code -y`
Codex: `npx skills add eigent-ai/eigent --skill skill-security-auditor -g -a codex -y`
Cursor: `npx skills add eigent-ai/eigent --skill skill-security-auditor -g -a cursor -y`
Gemini CLI: `npx skills add eigent-ai/eigent --skill skill-security-auditor -g -a gemini-cli -y`

## Description

Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on \"security audit\", \"vulnerability scan\", \"code review for security\", \"find secrets\", \"check for vulnerabilities\", \"OWASP\", \"CVE\", or questions about code security.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Auditor Guide

## Overview

This guide covers security auditing workflows for source code, dependencies, and configurations. For detailed vulnerability patterns and detection rules, see references/vulnerability-patterns.md. For secrets detection patterns, see references/secrets-patterns.md.

## Quick Start

Run the bundled scan script against a project directory:

```bash
python scripts/scan_project.py /path/to/project
```

This performs a lightweight scan for common issues: hardcoded secrets, dangerous function calls, and insecure patterns. For deeper analysis, follow the workflows below.

### Testing the scripts

```bash
python scripts/scan_project.py /path/to/some/project --format text
python scripts/scan_secrets.py /path/to/some/project --format text
```

## Audit Workflow

### 1. Reconnaissance

Before auditing, understand the project:

```bash
# Identify languages, frameworks, and entry points
find . -type f -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.go" -o -name "*.java" | head -20
cat package.json pyproject.toml requirements.txt go.mod pom.xml 2>/dev/null
```

Key questions:
- What frameworks are used? (Express, Django, Flask, Spring, etc.)
- Where are the entry points? (routes, controllers, API handlers)
- How is authentication handled?
- What external services are called?
- Is user input accepted? Where?

### 2. Secrets Detection

Scan for hardcoded credentials, API keys, and tokens. See references/secrets-patterns.md for the full pattern list.

```bash
python scripts/scan_secrets.py /path/to/project
```

Common patterns to check:
- API keys and tokens in source files
- Database connection strings with embedded passwords
- Private keys or certificates committed to the repo
- `.env` files or config files with plaintext secrets
- Secrets in CI/CD configuration files

### 3. Vulnerability Scanning

#### OWASP Top 10 Checklist

The rest: https://github.com/eigent-ai/eigent/blob/HEAD/resources/example-skills/skill-security-auditor/SKILL.md