security audit

Security vulnerabilities and leaked secrets often hide in the logic gaps where automated scanners can't reach. This skill provides a systematic, defensive audit framework that combines automated scanning with deep architectural reasoning to find and rank exploitable weaknesses in your codebase.

What it does

• Multi-tool scanning runs semgrep, gitleaks, and dependency checkers to catch known patterns and CVEs.
• OWASP alignment maps every finding to the Top 10:2025 categories and specific CWE IDs.
• Risk quantification calculates Likelihood and Impact independently to produce accurate OWASP Risk Ratings.
• Secret detection scans code and full git history for leaked credentials with automated redaction.
• Logic gap analysis identifies broken access control and architectural flaws that standard SAST tools miss.
• Remediation planning generates a prioritized work list ordered by exposure risk and operational urgency.

How it works

1. Initial Recon analyzes the tech stack, file structure, and CI config to propose an audit brief.
2. Brief Approval requires explicit user sign-off on scope, history scanning, and network access before execution.
3. Execution & Triage runs authorized scanners and filters false positives through manual verification.
4. Manual Review evaluates the code against the OWASP Top 10 to find flaws in auth, logic, and data handling.
5. Reporting delivers a formal audit and a remediation plan with redacted fingerprints for any discovered secrets.

Frameworks & tools

The skill utilizes semgrep, gitleaks, trivy, and ecosystem-specific auditors like npm audit or pip-audit. It follows the OWASP Top 10:2025 methodology and uses a custom Python normalization script for data deduplication.

Why this beats prompting it yourself

Generic prompts often result in a wall of unverified scanner output or hallucinated vulnerabilities. This skill enforces a "gate" system for authorization and a formal risk matrix, ensuring findings are reachable, exploitable, and ranked by actual business impact rather than arbitrary severity labels.

Use cases

• Reviewing authentication and authorization logic before a production launch.
• Identifying leaked credentials in legacy git history during a security cleanup.
• Performing a mandatory OWASP-aligned vulnerability assessment for compliance.
• Auditing third-party dependencies for reachable CVEs and supply chain risks.

Known limitations

This skill is strictly defensive and will not produce weaponized exploit payloads. It requires local installation of scanners like semgrep or gitleaks to perform automated analysis.