Agent skill
auditing-security
Audits repository security by analyzing current code and commit history for sensitive information leaks. Detects API keys, passwords, and credentials. Use for "보안 점검", "보안 감사", "security audit", "민감 정보 검사" requests.
Install this agent skill to your Project
npx add-skill https://github.com/jiunbae/agent-skills/tree/main/security/security-auditor
SKILL.md
Security Auditor
Repository security audit for sensitive information detection.
Detection Targets
| Type | Pattern Examples |
|---|---|
| API Keys | sk-, AKIA, ghp_, xoxb- |
| Passwords | PASSWORD=, password:, hardcoded strings |
| User Paths | /Users/realname/, /home/realname/ |
| DB Strings | mongodb://, postgres:// with credentials |
Auto-Excluded (False Positives)
- Placeholders:
/Users/username,your-api-key - Test dirs:
test/,examples/,fixtures/ - Template values:
CHANGE_ME,xxx
Workflow
Step 1: Check Git-Tracked Sensitive Files
# Files that SHOULD be gitignored
git ls-files | grep -E '\.(env|key|pem|p12)$'
Note: Files existing locally is OK. Problem is when they're git-tracked.
Step 2: Scan Code for Secrets
# API keys
grep -rn "sk-[a-zA-Z0-9]\\{20,\\}" --include="*.ts" --include="*.py"
# Hardcoded passwords (case-insensitive)
grep -rni "password.*=.*['\"]" --include="*.ts" --include="*.py"
Step 3: Check Git History
# Search past commits for leaked secrets
git log -p --all -S "password" -- "*.ts" "*.py"
git log -p --all -S "sk-" -- "*.ts" "*.py"
Step 4: Verify .gitignore
# Ensure sensitive patterns are ignored
cat .gitignore | grep -E "env|key|secret"
Report Format
## Security Audit Report
### 🔴 Critical
- [file:line] Hardcoded API key detected
### 🟡 Warning
- [file:line] User path found
### ✅ Passed
- .env properly gitignored
- No secrets in git history
Difference from git-commit-pr
| Skill | Scope | When |
|---|---|---|
git-commit-pr |
Changed files only | At commit time |
security-auditor |
Entire repo + history | Periodic audit |
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
jiunbae/agent-skills
implementing-in-background
Orchestrates multiple AI agents (Claude, Codex, Gemini) for parallel implementation in the background. Separates independent tasks from planning docs, each agent writes code directly. Context-safe with auto-save. Use for "백그라운드 구현", "bg impl", "병렬 구현", "Codex로 구현", "구현해줘", "코드 작성해줘" requests.
jiunbae/agent-skills
review-fix-loop
Autonomous review-fix cycle that continuously reviews code using background-reviewer, fixes issues, and repeats until all findings are resolved. Use for "리뷰 루프", "자동 개선", "review fix loop", "리뷰 반복", "코드 개선 루프", "keep reviewing" requests.
jiunbae/agent-skills
planning-in-background
Orchestrates multiple AI agents (Claude, Codex, Gemini) for parallel planning in the background with auto-save. Agents continue running even when session hits context limits. Use for "백그라운드 기획", "bg plan", "병렬 기획", "멀티 AI 기획", "기획해줘", "N명이 기획", "계획", "플래닝", "plan", "설계" requests.
jiunbae/agent-skills
background-reviewer
Orchestrates multi-LLM parallel code review using Claude, Codex, and Gemini. Each agent reviews from a different perspective using agent personas (security, architecture, code quality, performance). Supports persona-based review via `agt persona review`. Use for "코드 리뷰", "리뷰해줘", "bg review", "멀티 리뷰", "background review", "페르소나 리뷰" requests.
jiunbae/agent-skills
managing-context
Discovers and loads relevant project context from markdown documentation before each task. Matches context documents based on keywords, file paths, and task types. Use at task start to access project plans, architecture, and implementation status.
jiunbae/agent-skills
indexing-static-context
Provides an index of global static context files in ~/.agents/. Returns appropriate static file paths for natural language queries like "내 정보", "보안 규칙". Use when other skills or agents need to locate reference information.
Didn't find tool you were looking for?