Security Audit Bundle — 8 skills

About this skill

What's included (8 skills)

• ci-cd-security-audit

  Statically audit GitHub Actions workflow files for the classic CI/CD supply-chain mistakes — unpinned uses: refs, pull_request_target abuse, script injection via ${{ github.event.* }} in run blocks, missing or over-broad permissions, PR-head checkouts under pull_request_target, and secrets echoed in run lines. Emits a JSON report with id/severity/file/line/detail/recommendation per finding. Use when the user asks to review or secure GitHub workflows, harden CI/CD, or audit Actions for supply-chain risk.

• cors-misconfig-check

  Probe the CORS policy of an endpoint the user owns — tests whether foreign origins are reflected, wildcard is combined with credentials, and preflight allows dangerous methods/headers. JSON findings. Use when reviewing API CORS config before release.

• dns-email-security-check

  Check the public email-security posture of a domain you own — SPF (policy, multiple records, the 10-DNS-lookup budget), DMARC (policy strength, rua reporting), DKIM (common selectors), MX health, and optionally TLS certificate expiry — and turn the JSON findings into a concrete DNS to-do list. Use when the user asks why their mail lands in spam, whether their domain can be spoofed, or to audit SPF/DMARC/DKIM configuration.

• docker-security-lint

  Statically lint Dockerfiles and docker-compose files for common security mistakes — mutable or untagged base images, missing USER directive, secrets baked into ENV/ARG/environment, curl|sh installs, remote ADD, privileged containers, host networking, 0.0.0.0 port bindings, docker.sock mounts, and dangerous capabilities (SYS_ADMIN/ALL). Emits a JSON report with masked secret fingerprints only. Use when the user asks to audit, review, or lint container build files or compose stacks before building or shipping.

• env-config-audit

  Audit a project directory for dotenv configuration hygiene — .env files not covered by .gitignore rules, placeholder or weak values, duplicate keys, .env.example/.env parity drift, and env files sitting in src/ or public/ folders. Reports key names only — env values are never emitted. Use when the user asks to check env files, .gitignore coverage, or dotenv hygiene before committing.

• git-history-leak-check

  Scan a repository's full git history for credentials that were committed at any point — including secrets deleted from the working tree long ago. Runs `git rev-list` + `git grep` over every revision and prints a JSON report with masked fingerprints only — raw secret values are never emitted. Use when the user asks whether a secret was ever committed, to audit a repo before open-sourcing it, during incident response for a leaked key, or before purging git history.

• jwt-inspector

  Decode and statically inspect JSON Web Tokens for security problems — alg=none, algorithm-confusion (RS/HS) risk, hostile kid header values, missing or far-future expiry, and sensitive claims leaked into the payload. Decode-only (no signature verification); prints a JSON report with sensitive values masked. Use when the user asks to check, debug, or audit a JWT or bearer token.

• secret-leak-scan

  Statically scan a project directory, build output, or .asar archive for leaked credentials (AWS access keys, GitHub PATs, Slack tokens, Stripe live keys, Google API keys, private-key blocks) before committing or releasing. Prints a JSON report with masked fingerprints only — raw secret values are never emitted. Use when the user asks to check for leaked secrets, exposed keys, committed credentials, or to gate a commit/release on secret leaks.