More screenshots
Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsSecurity Vulnerability Audit Gate
Audit supplied code and configuration, prioritize security findings, and return a clear PASS, REVISE, or BLOCK release decision.
$15
Security Vulnerability Audit Gate
Example session with this skill installed
Perform a security audit on this PR: it adds a new AWS Lambda function, a Terraform file defining an IAM role with 'Resource': '*', and updates package-lock.json with three new dependencies.
- Read your context and instructions
- Compiled the security vulnerability audit
- Generated the document
The security audit for the provided PR artifacts is complete. The review identified a critical misconfiguration in the infrastructure code and one high-risk dependency.
Security Audit Report
Gate Decision: BLOCK
Confidence: High
Scope: AWS Lambda source, Terraform IAM configuration, NPM lockfile.
| ID | Finding | Severity | Location | Rationale |
|---|---|---|---|---|
| SEC-001 | Over-privileged IAM Policy | CRITICAL | main.tf L14 | 'Resource': '*' allows the Lambda to access all resources in the account. Violation of least privilege. |
| SEC-002 | Vulnerable Dependency | HIGH | package-lock.json | axios@0.21.0 is present; susceptible to SSRF (CVE-2020-28168). |
| SEC-003 | Missing Function Logging | LOW | index.js | CloudWatch logging is not explicitly configured for error catching. |
| VER-001 | Secret Exposure | NOT_VERIFIED | N/A | Environment variable configuration not provided; cannot verify if secrets are injected safely. |
Executive Summary
The release is blocked due to a CRITICAL IAM misconfiguration that exposes the entire AWS account to the Lambda execution context. Additionally, a HIGH severity vulnerability in the axios library must be patched before deployment.
Remediation Plan
Immediate: Update main.tf to restrict the IAM Resource block to the specific ARNs required for function execution.
2. Immediate: Upgrade axios to version 0.21.1 or higher in package.json and regenerate the lockfile.
3.
Follow-up: Provide the template.yaml or CI environment config to verify secret handling for the NOT_VERIFIED check.
Next steps
- Apply the IAM policy restriction to specific resource ARNs.
- Run
npm update axiosand resubmit thepackage-lock.json. - Provide the environment variable configuration for a final credential audit.
security-vulnerability-audit-gate.pdf
PDF · document
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
Security Vulnerability Audit Gate performs an evidence-based defensive security review of the code, configuration, dependency, infrastructure, CI/CD, and deployment artifacts you provide. It traces security issues from entry point to affected asset, separates confirmed findings from assumptions and missing evidence, and prioritizes remediation by severity and confidence.
Every review returns a clear PASS, REVISE, or BLOCK release decision, structured findings, precise affected locations, actionable remediation, ownership suggestions, residual risk, and retest conditions. Missing material evidence is reported as NOT_VERIFIED instead of being treated as proof of safety.
Use it for pre-release reviews, change audits, production-readiness checks, secure code review, dependency and supply-chain assessment, secrets handling, authentication, authorization, tenant isolation, infrastructure configuration, and deployment controls.
The skill uses static reasoning over supplied artifacts. It does not access external systems, test credentials, exploit live targets, or generate weaponized attack instructions. No API keys, scripts, network access, or external scanners are required.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 24 days ago
- Passed all security checks, Safe to install