Skills security-analyzer

📦

security-analyzer

Name: security-analyzer
Author: Cornjebus

Content revision r1 Safe 🌐 Network access📁 Filesystem access⚙️ External commands

Analyze Project Security Risks

Security reviews are slow when dependency, container, and IaC data are spread across a repository. This skill inventories assets, checks OSV.dev, and drafts prioritized remediation reports.

Supports: Claude Codex Code(CC)

🥈 80 Silver

This skill is part of a pack

Install the whole pack to get every skill the task needs, in one command.

OpenClaw Security Monitor · 3 skills Install whole pack

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "security-analyzer" from https://skillstore.io/skills/cornjebus-security-analyzer.md and its manifest at https://skillstore.io/api/skills/cornjebus-security-analyzer/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/cornjebus-security-analyzer.md Signed manifest GET /api/skills/cornjebus-security-analyzer/manifest Signed lockfile GET /api/skills/cornjebus-security-analyzer/lockfile

Test it

Using "security-analyzer". Run a security scan before release.

Expected outcome:

The skill reports dependency counts, container and IaC files, secret exposure risk, OSV.dev vulnerability totals, and priority phases.

Using "security-analyzer". Explain the highest risk dependency issues.

Expected outcome:

The skill lists top vulnerabilities with affected packages, severity, risk score, remediation direction, and validation guidance.

Using "security-analyzer". Create an executive security summary.

Expected outcome:

The skill summarizes overall posture, vulnerability counts by priority, estimated remediation effort, and recommended next actions.

Security Audit

Safe

v8 • 7/5/2026 Open versioned report

AI review found that the high static score is driven by expected security scanner behavior and Markdown or generated-code examples. The scripts query OSV.dev for dependency vulnerabilities, enumerate .env filenames without reading values, and generate reports instead of executing fixes. No prompt injection, credential exfiltration, or hidden command execution evidence was found.

Files scanned

1,084

Lines analyzed

Review items

False positives ignored

Risk Factors

🌐 Network access (4)

scripts/fetch_vulns.py:10 scripts/fetch_vulns.py:41 scripts/fetch_vulns.py:48 scripts/fetch_vulns.py:14

📁 Filesystem access (8)

scripts/fetch_vulns.py:135 scripts/fetch_vulns.py:173 scripts/generate_report.py:256 scripts/generate_report.py:123 scripts/generate_report.py:141 scripts/generate_report.py:254 SKILL.md:79 SKILL.md:81

⚙️ External commands (36)

No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/cornjebus-security-analyzer/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/cornjebus-security-analyzer/security.svg)](https://skillstore.io/skills/cornjebus-security-analyzer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/cornjebus-security-analyzer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cornjebus-security-analyzer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/cornjebus-security-analyzer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Cornjebus. (2026). security-analyzer security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cornjebus-security-analyzer/audits/8

BibTeX citation

@techreport{cornjebus-cornjebus-security-analyzer-2026,
  author = {Cornjebus},
  title = {security-analyzer security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/cornjebus-security-analyzer/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-analyzer security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "Cornjebus"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/cornjebus-security-analyzer/audits/8"
identifiers:
  - type: other
    value: "skillstore:cornjebus-security-analyzer:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Repository Security Review

Inventory dependencies, containers, infrastructure files, and possible secret exposure before a release.

DevOps Configuration Check

Identify container and cloud configuration files that need security review and remediation planning.

Remediation Planning

Turn vulnerability scan results into prioritized technical and executive report sections.

Try These Prompts

Scan a Project

Use security-analyzer to scan this repository and summarize dependency, container, IaC, and secret exposure risks.

Review Dependencies

Use security-analyzer to inventory supported dependency manifests, query OSV.dev, and rank findings by remediation priority.

Plan Remediation

Use security-analyzer to create a phased remediation plan with risk scores, owner-ready actions, and validation test guidance.

Prepare Leadership Report

Use security-analyzer to produce an executive summary and a technical report from the latest inventory and vulnerability results.

Best Practices

Run scans from the intended project root and review the inventory before sharing results.
Confirm external OSV.dev lookups are acceptable for private package names and versions.
Review generated fix commands and tests before applying changes to production projects.

Avoid

Do not run scans on repositories that contain secrets unless handling rules are clear.
Do not execute generated remediation commands without validating package names and versions.
Do not treat generated reports as a complete security assessment without human review.