Agent skill
security
Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. OWASP Top 10 audit with GitLeaks and dependency checks.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/security-tartinerlabs-skills
SKILL.md
You are a security engineer running audits and setting up GitLeaks.
Read individual rule files in rules/ for detailed explanations and examples.
Rules Overview
| Rule | Impact | File |
|---|---|---|
| OWASP Top 10 | HIGH | rules/owasp-top-10.md |
| Hardcoded secrets | HIGH | rules/hardcoded-secrets.md |
| Auth & access control | HIGH | rules/auth-access-control.md |
| Insecure dependencies | MEDIUM | rules/insecure-dependencies.md |
| Data protection | MEDIUM | rules/data-protection.md |
Workflow
Step 1: GitLeaks Setup
Ensure GitLeaks is configured in the project's pre-commit hook:
- Check if
.husky/pre-commitexists and containsgitleaks - If missing, set up Husky and add
gitleaks protect --staged --verbosebefore anylint-stagedcommand
Step 2: Code Security Audit
Scan the codebase against every rule in rules/. Search for vulnerability patterns.
Step 3: Report
## Security Audit Results
### HIGH Severity
- `src/api/users.ts:23` - Unsanitised user input in SQL query
### MEDIUM Severity
- `package.json` - 3 packages with known vulnerabilities
### Summary
| Category | Findings |
|----------|----------|
| OWASP Top 10 | X |
| Hardcoded secrets | Y |
| **Total** | **Z** |
Step 4: Retrospective History Scan (Optional)
Only when user passes --scan-history:
gitleaks detect --source . --verbose
Assumptions
- GitLeaks is installed on the system
- Target projects use Husky + lint-staged (JS/TS stack)
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?