技能 when-auditing-security-use-security-analyzer
🔒

when-auditing-security-use-security-analyzer

安全 ⚡ 包含腳本🌐 網路存取📁 檔案系統存取⚙️ 外部命令🔑 環境變數

Run comprehensive security audits with multi-agent coordination

Security vulnerabilities often go undetected until it is too late. This skill performs automated security auditing across 5 vectors to identify SQL injection, XSS, path traversal, and other vulnerabilities before attackers do.

支援: Claude Codex Code(CC)
⚠️ 67
1

下載技能 ZIP

2

在 Claude 中上傳

前往 設定 → 功能 → 技能 → 上傳技能

3

開啟並開始使用

測試它

正在使用「when-auditing-security-use-security-analyzer」。 Run security audit on our Express API

預期結果:

  • Static Analysis: 3 SQL injection vulnerabilities found in user routes
  • Dynamic Testing: CSRF protection missing on /api/transfer endpoint
  • Dependencies: No critical CVEs found
  • Secrets: 2 exposed API keys detected in config files
  • OWASP Score: 75 percent (PASS - above 70 percent threshold)
  • Report saved to: /tmp/SECURITY-AUDIT-REPORT.md

正在使用「when-auditing-security-use-security-analyzer」。 Scan for secrets after adding Stripe integration

預期結果:

  • Pattern Scan: Found 1 potential Stripe secret key in src/config.js
  • Entropy Analysis: 3 high-entropy strings flagged for review
  • Environment Check: 5 process.env accesses reviewed - 2 need masking
  • Recommendation: Move Stripe key to environment variables immediately

正在使用「when-auditing-security-use-security-analyzer」。 Check OWASP compliance before release

預期結果:

  • A01 Broken Access Control: PASS (authorization checks present)
  • A02 Cryptographic Failures: FAIL (md5 usage detected in auth.js)
  • A03 Injection: WARN (2 SQL injection patterns need review)
  • A06 Vulnerable Components: PASS (no critical CVEs)
  • Overall Compliance: 78 percent - Review high-priority items before release

安全審計

安全
v5 • 1/17/2026

This is a legitimate security auditing skill. All 777 static findings are FALSE POSITIVES - patterns detected in documentation describe VULNERABILITY EXAMPLES that the skill is designed to detect in user codebases, not actual exploits. The skill performs defensive security scanning across 5 vectors with proper validation gates.

8
已掃描檔案
3,767
分析行數
5
發現項
5
審計總數
審計者: claude 查看審計歷史 →

品質評分

38
架構
100
可維護性
85
內容
19
社群
100
安全
74
規範符合性

你能建構什麼

Pre-commit security checks

Integrate security scanning into git hooks to catch vulnerabilities before code reaches production

Compliance auditing

Generate OWASP compliance reports for security audits and regulatory requirements

CI/CD pipeline security

Automate security scanning in build pipelines with fail-fast on critical vulnerabilities

試試這些提示

Quick security scan
Run a quick security audit on this codebase to check for common vulnerabilities
Pre-deployment audit
Perform comprehensive security testing including dynamic tests before we deploy to production
Secrets detection only
Scan for exposed API keys, passwords, and secrets in the codebase
Compliance check
Generate OWASP Top 10 compliance report with recommendations for improving our security posture

最佳實務

  • Run security audits before every major release or when adding new dependencies
  • Set up automated scanning in CI/CD pipelines with strict mode for critical issues
  • Review and fix critical vulnerabilities immediately, high issues within the sprint

避免

  • Ignoring security warnings without understanding the risk
  • Running audits only at project end instead of continuously
  • Focusing only on static analysis without testing runtime vulnerabilities

常見問題

Which programming languages does this support?
Currently optimized for JavaScript and TypeScript Node.js applications. Support for Python, Go, and Java planned.
How long does a full security audit take?
Typically 5 to 10 minutes depending on codebase size. Static analysis is fastest, dynamic testing takes longest.
Can I integrate this with GitHub Actions?
Yes, add the skill command to your workflow. Use the strict flag to fail builds on critical vulnerabilities.
What happens if critical vulnerabilities are found?
The skill exits with code 1 and stops the pipeline. Review the generated report for specific remediation steps.
How accurate is the secrets detection?
Uses pattern matching and entropy analysis. May flag test keys or placeholders. Always review findings manually.
Does this replace penetration testing?
No, this complements but does not replace manual security testing. Use for continuous automated scanning.