skill-security-auditor
eigent-ai/eigent / resources/example-skills/skill-security-auditor
audits code and configs: flaws, secrets, CVEs , which improves: reduces risks before production
Details
- judge’s score
- 8/10
- place
- outside the packs
- publisher
- eigent-ai
- status
- new
- pinned commit
- 687ddc8 on GitHub (new tab)
- skill’s last commit
- Mar 18, 2026
- repo stars
- 15,620
- main type
- Other
Judgement
Precise triggering and clear scope. The value lies mostly in an OWASP checklist and secret regexes, partly already known to Claude. Scripts not provided, so not verifiable here. Score 8/10.
reservations
- The scripts scan_project.py and scan_secrets.py are cited but their content is not provided: their logic and false positives cannot be verified.
- references/vulnerability-patterns.md is truncated (5000 characters out of 6970): the end of the patterns was not assessed.
- Largely generic content (OWASP checklist, well-known best practices); little Claude Code-specific know-how.
- Triggering
- 2/2
- Added value
- 1/2
- Precision
- 1/2
- Scope
- 2/2
- Quality
- 2/2
Alerts
4 alerts, by category
Static scan
- high risk
scripts run by the SKILL.md
scripts/scan_project.py, scripts/scan_secrets.py
- info risk
dynamic code execution (in a code example, to be verified)
Network
- high risk
The proposed audit commands include "npx auditjs ossi", which downloads and runs a remote npm package without a pinned version.
Execution
- high risk
The embedded scripts read an entire project; if run on an untrusted repository, their code has not been audited here.
Original description
Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs,…
added on Oct 18, 2026 · license Apache-2.0