SkillSmith Repo Security Audit
Most security bugs ship not because they're hard to fix, but because nobody looked before merge. This looks — and hands you a ranked fix list, not an attack.
What it does
Point it at a repository, a pasted package manifest, or a code snippet, and it runs a five-pass defensive audit: outdated dependencies with known vulnerabilities, hardcoded secrets, insecure coding patterns, and configuration-hardening gaps — every finding mapped to an OWASP Top 10 category and sorted by severity, each with a concrete remediation.
It is built around one hard line: defense only. It surfaces what's wrong and how to fix it, and refuses to produce exploits, payloads, or attack instructions. It also refuses to fabricate CVE numbers — if a vulnerability can't be verified, it says so and tells you to confirm against the advisory. The output is plain text you own; it runs in a sandbox with no paid API.
How it works
A five-pass workflow, assembled into one fixed-format report:
| Pass | Output |
|---|---|
| 1. Dependency vulnerabilities | Outdated/known-vulnerable packages + recommended upgrade — never an invented CVE |
| 2. Secret & credential scan | Hardcoded API keys / passwords / tokens, masked, with "rotate + move to env/secret manager" |
| 3. Insecure code patterns | Injection, unsafe deserialization, weak randomness, missing validation — risk + fix, no exploit |
| 4. Configuration hardening | Security headers, CORS, permissions, secret management recommendations |
| 5. OWASP Top 10 + remediation | Every finding mapped to OWASP 2021 and ranked Critical → Low with fix priority |
⭐ Featured example — auditing a small web service
Input: "Audit this repo: a requirements.txt plus an app.py for a Flask service."
Output: a findings table — flagged dependencies, a leaked API key (masked), and insecure patterns described defensively with their fixes and severities:
![Defensive audit findings: flagged dependencies, masked leaked secret, and insecure patterns with severity — no exploit content]
And the prioritized remediation plan — every finding mapped to OWASP Top 10 and ordered by severity, Critical first:
![OWASP Top 10 mapping and severity-ranked remediation plan, Critical to Low, each with a concrete fix]
From a real run of this Skill on a fixture repo: dependency, secret, code-pattern, and config findings, each with a fix and an OWASP mapping — and not a single fabricated CVE or line of attack code.
Why it's different
- Defensive by construction. A built-in red line refuses exploits, PoCs, payloads, and attack instructions, and redirects every "how would an attacker..." framing into a fix. You can run it on your own code without it ever producing a weapon.
- It won't lie about CVEs. Most ad-hoc "AI security reviews" hallucinate plausible-looking CVE numbers. This one prints a CVE only when it's verifiable; otherwise it states the concern and says "verify against the advisory."
- One report, five dimensions, one ranking. Dependencies, secrets, code patterns, and config in a single fixed format, all reconciled into one severity-ranked OWASP remediation list — so a small team knows exactly what to fix first.
- Consolidates what four free tools each do — into one read.
pip-audit/npm audit,gitleaks, andSemgrepeach cover one slice and emit their own raw output. This runs all four dimensions, queries OSV.dev for real advisory IDs when it can reach the network, and hands back a single OWASP-ranked report with plain-language fixes — the value is the integration and the prioritization, for a team that hasn't wired those tools into CI. If you already run Snyk/Dependabot in CI, you don't need this. - Sandbox-ready and self-owned. Plain-text in/out, no paid API, no data leaves your environment.
Disclaimer / Scope
This Skill is an audit aid that helps identify and remediate risk. It is not a penetration test, not a security guarantee, and its findings are not exhaustive. Confirm dependency advisories against an authoritative source before acting, and engage a professional security audit for high-stakes systems.
