Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsSecurity Audit Report Skill
Converts raw security scanner logs into structured, prioritized audit reports with actionable remediation roadmaps.
$4.99
Security Audit Report Skill
Example session with this skill installed
Convert these Trivy and Snyk JSON logs into a security audit report. Include an executive summary, deduplicate findings, and provide a remediation roadmap. Redact any secrets.
- Read your context and instructions
- Compiled the security audit report
I have processed the Trivy and Snyk logs. I identified 12 raw records, which were deduplicated into 8 unique findings across 2 containers. All exposed secrets in the logs have been masked.
Security Audit Report
1. Report Overview
- Assessment scope: Based on supplied container scan logs (Trivy, Snyk).
- Source tools: Trivy v0.43.1, Snyk CLI.
- Data limitations: No manual verification evidence was provided; all findings are scanner-reported.
- Validation status: All items are currently "Scanner-reported".
2. Executive Summary
The scan identified 8 unique vulnerabilities within the production container images. The primary risks involve outdated base image libraries and two high-severity dependency vulnerabilities in the Node.js runtime. Immediate updates to the Dockerfile base images are recommended to mitigate known exploits.
3. Findings Summary
| Priority | Count | Summary |
|---|---|---|
| High | 2 | Dependency vulnerabilities (CVE-2023-xxxx) |
| Medium | 5 | Outdated OS libraries in base image |
| Low | 1 | Hardening: Unnecessary build tools present |
4. Detailed Findings
[High] Prototype Pollution in 'lodash'
- Finding ID / source: SNYK-JS-LODASH-567
- Status: Scanner-reported
- Affected asset:
frontend-app:latest(/app/package-lock.json) - Original severity / score: High / 7.5
- Confidence: High
- Evidence: Found lodash version 4.17.15; vulnerable below 4.17.21.
- Why it matters: Allows attackers to inject properties into object prototypes, potentially leading to RCE.
- Recommended remediation: Update
lodashto version 4.17.21 or higher. - Validation / retest steps: Run
npm list lodashand verify version >= 4.17.21.
5. Remediation Roadmap
| Priority | Action | Related finding IDs | Suggested owner role | Validation |
|---|---|---|---|---|
| Immediate | Update lodash dependency | SNYK-JS-LODASH-567 | Frontend Developer | npm list |
| Near-term | Rebuild base image to latest Alpine | TRV-001, TRV-002 | DevOps Engineer | trivy image |
Next steps
- Review the High priority findings for immediate patching.
- Trigger a new scan after updating the
package-lock.json. - Verify the base image version in the CI/CD pipeline.
Connects securely to your tools. The creator never sees your data.
About this skill
Security scanner logs are often unreadable for clients and overwhelming for developers. This skill converts raw data from SAST, DAST, dependency, and cloud infrastructure scanners into structured, professional audit reports. It eliminates the friction of manual triage by normalizing disparate tool outputs into a single prioritized roadmap.
What it does
- Finding normalization groups duplicate issues from different tools while preserving original source identifiers.
- Evidence-based triaging assigns confidence levels to ensure scanner noise is distinguished from validated vulnerabilities.
- Remediation mapping generates actionable fix instructions and validation steps for technical teams.
- Executive reporting synthesizes complex logs into plain-language summaries for business stakeholders.
- Data sanitization automatically masks secrets, tokens, and sensitive identifiers found in log exports.
How it works
- Provide raw scanner outputs in formats like JSON, SARIF, CSV, or text logs.
- The skill parses the findings, extracting asset paths, severity scores, and technical evidence.
- Findings are deduplicated and assigned a status, such as "Scanner-reported" or "Evidence-supported".
- A structured Markdown report or JSON object is generated, including an executive summary and a remediation roadmap.
Frameworks & tools
Compatible with any tool exporting findings, including SAST/DAST suites, OWASP Dependency-Check, Snyk, Trivy, AWS Inspector, and SARIF-compliant scanners.
Why this beats prompting it yourself
Generic prompts often hallucinate CVE details or treat every scanner alert as a confirmed breach. This skill enforces strict evidence rules, preventing the fabrication of exploit results while maintaining rigorous traceability to the original tool output.
Use cases
- Converting Jenkins or GitHub Action scan logs into a readable PR summary.
- Preparing a vulnerability disclosure report for a non-technical client.
- Creating a deduplicated remediation backlog from multiple security tools.
- Generating a retest checklist to track which findings remain unresolved after a fix.
Known limitations
Does not perform active scanning or manual penetration testing. Report quality depends entirely on the detail provided in the input logs.
Does not perform active scanning or manual penetration testing. Report quality depends entirely on the detail provided in the input logs.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 12 days ago
Permissions
No special permissions declared or detected