Security Workbench: code security audit with recorded decisi

Manual security reviews are slow and prone to oversight, especially when implementing complex cryptographic standards. This skill provides a structured framework for code auditing and formal cryptography implementation, moving from paper specs to verified code.

What it does

• Code scanning identifies hardcoded secrets, injection points, and unsafe API patterns using tiered evidence levels.
• Dependency auditing checks unpinned container images and queries vulnerability databases for known risks.
• Cryptography implementation translates research papers, RFCs, or standards into specifications and tested code.
• Audit reporting generates structured findings with priorities, requiring human verification for every issue.
• Evidence tracking categorizes findings as tool-verified, test-verified, pattern-matched, or model-judgments.

How it works

1. Initialize the workbench in a project directory to create the local configuration and state tracking.
2. Execute scan for a rapid assessment of high-priority security flaws and leaked credentials.
3. Run audit for a deep-dive review involving threat modeling, checklists, and dependency verification.
4. Implement crypto by following the pipeline from intake and spec extraction to secure coding and final review.

Frameworks & tools

The workbench utilizes Python 3.11+ and PyYAML. It interacts with external advisory databases like OSV (with consent) and requires standard developer tools for running project-specific test vectors and fuzzers.

Why this beats prompting it yourself

Generic prompts often miss unpinned dependencies or provide confident but incorrect cryptographic implementations. This skill enforces a multi-stage verification pipeline that treats findings as candidates until verified by tools or tests, preventing silent assumptions.

Use cases

• Scan a legacy repository for hardcoded API keys and unpinned Docker images.
• Implement a new cryptographic primitive from a formal academic paper or RFC.
• Conduct a pre-release security audit including dependency checks and threat modeling.
• Compare multiple research papers to synthesize a single secure design for a project.

Known limitations

Requires Python 3.11 and PyYAML for scanner modules. Network access to vulnerability databases and execution of project code for testing require explicit user consent for each session.