# Analyze Project Security Risks

Security reviews are slow when dependency, container, and IaC data are spread across a repository. This skill inventories assets, checks OSV.dev, and drafts prioritized remediation reports.

## Install

```bash
npx skillstore add cornjebus/security-analyzer
```

## Metadata

- Status: approved
- Slug: cornjebus-security-analyzer
- Skillstore revision: r1
- Version status: missing
- Tree hash: 4360b650bef0175f0eb5ec8468ea6843d6ccbf0cce6ed60d48c17730ffdd510a
- Author: Cornjebus
- GitHub username: Cornjebus
- License: MIT
- Repository: https://github.com/Cornjebus/security-analyzer/tree/main/.claude/skills/security-analyzer
- Ref: 02f077c174c5335e2f5d02ca15e77b70d9543e58
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, filesystem, external\_commands
- Quality score: 80
- Quality tier: silver
- Public page: https://skillstore.pages.dev/skills/cornjebus-security-analyzer
- Manifest: https://skillstore.pages.dev/api/skills/cornjebus-security-analyzer/manifest

## Capabilities

- Discovers npm, pip, gem, and Go dependencies from common manifest files.
- Finds Docker, Docker Compose, Kubernetes, Terraform, and CloudFormation configuration files.
- Flags .env style files that may be exposed without reading secret values.
- Queries OSV.dev for known open source dependency vulnerabilities.
- Calculates simple vulnerability risk scores from severity, exploitability, criticality, and exposure.
- Generates technical and executive security report content with remediation guidance.

## Use Cases

- Repository Security Review: Inventory dependencies, containers, infrastructure files, and possible secret exposure before a release.
- DevOps Configuration Check: Identify container and cloud configuration files that need security review and remediation planning.
- Remediation Planning: Turn vulnerability scan results into prioritized technical and executive report sections.

## Prompt Templates

### Scan a Project

```
Use security-analyzer to scan this repository and summarize dependency, container, IaC, and secret exposure risks.
```

### Review Dependencies

```
Use security-analyzer to inventory supported dependency manifests, query OSV.dev, and rank findings by remediation priority.
```

### Plan Remediation

```
Use security-analyzer to create a phased remediation plan with risk scores, owner-ready actions, and validation test guidance.
```

### Prepare Leadership Report

```
Use security-analyzer to produce an executive summary and a technical report from the latest inventory and vulnerability results.
```

## Limitations

- OSV.dev lookups send package names and versions to an external service.
- The scanner does not replace manual penetration testing or threat modeling.
- Generated fix commands and validation tests require human review before use.
- Coverage depends on supported manifest and infrastructure file patterns.

## Best Practices

- Run scans from the intended project root and review the inventory before sharing results.
- Confirm external OSV.dev lookups are acceptable for private package names and versions.
- Review generated fix commands and tests before applying changes to production projects.

## Anti Patterns

- Do not run scans on repositories that contain secrets unless handling rules are clear.
- Do not execute generated remediation commands without validating package names and versions.
- Do not treat generated reports as a complete security assessment without human review.

## Security Audit

- Audited at: 2026-07-05T07:10:16.807\+00:00
- Summary: AI review found that the high static score is driven by expected security scanner behavior and Markdown or generated-code examples. The scripts query OSV.dev for dependency vulnerabilities, enumerate .env filenames without reading values, and generate reports instead of executing fixes. No prompt injection, credential exfiltration, or hidden command execution evidence was found.

## Stats

- Views: 213
- Downloads: 21
- Favorites: 0
- Popularity score: 0