Security Auditor

This is your pre-deployment security scanner that catches vulnerabilities before they ship. It runs dependency audits (npm audit, pip-audit), hunts for leaked secrets using entropy analysis and regex patterns, and does static analysis for OWASP Top 10 issues like SQL injection and XSS. The documentation is solid with clear decision trees on severity handling and language-specific gotchas. Best used in CI/CD pipelines where it can fail builds on critical findings. Not a penetration testing tool and won't help with runtime security or compliance certifications. The anti-pattern section on audit fatigue is spot on: prioritize by exploitability or your team will ignore everything. Pairs well with deployment automation skills for secure pipelines.

skills.sh installs: 123
GitHub stars: 113
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add erichowens/some_claude_skills --skill security-auditor --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Auditor

Comprehensive security scanning for codebases. Identifies vulnerabilities before they become incidents. Focuses on actionable findings with remediation guidance.

When to Use

Use for:

Pre-deployment security audits
Dependency vulnerability scanning
Secret/credential leak detection
Code-level SAST (Static Application Security Testing)
Security posture reports for stakeholders
OWASP Top 10 compliance checking
Pre-PR security reviews

Do NOT use for:

Runtime security (WAF, rate limiting) - use infrastructure tools
Network security/firewall rules - use cloud/DevOps skills
SOC2/HIPAA/PCI compliance - requires legal/organizational process
Penetration testing execution - this is detection, not exploitation

Quick Start

Full Security Audit

# Run comprehensive scan
./scripts/full-audit.sh /path/to/project

# Output: security-report.json + summary

Quick Checks

# Dependency vulnerabilities only
npm audit --json > deps-audit.json

# Secret detection only
./scripts/detect-secrets.sh /path/to/project

# OWASP check specific file
./scripts/owasp-check.py /path/to/file.js