Skills when-auditing-security-use-security-analyzer

📦

when-auditing-security-use-security-analyzer

Name: when-auditing-security-use-security-analyzer
Author: DNYoussef

v1.0.0 Content revision r1 Medium Risk 🌐 Network access⚡ Contains scripts⚙️ External commands📁 Filesystem access🔑 Env variables

Run Security Audits with AI Agents

Security reviews often miss issues spread across code, dependencies, runtime behavior, and secrets. This skill guides Claude, Codex, and Claude Code through a structured audit workflow with reporting gates.

Supports: Claude Codex Code(CC)

📊 70 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "when-auditing-security-use-security-analyzer" from https://skillstore.io/skills/dnyoussef-when-auditing-security-use-security-analyzer.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-auditing-security-use-security-analyzer/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dnyoussef-when-auditing-security-use-security-analyzer.md Signed manifest GET /api/skills/dnyoussef-when-auditing-security-use-security-analyzer/manifest Signed lockfile GET /api/skills/dnyoussef-when-auditing-security-use-security-analyzer/lockfile

Test it

Using "when-auditing-security-use-security-analyzer". Run a static security scan before my pull request.

Expected outcome:

Summary of issue counts by severity.
List of likely SQL injection, XSS, path traversal, and crypto findings.
Recommended fixes ordered by impact.

Using "when-auditing-security-use-security-analyzer". Check whether this release has new security regressions.

Expected outcome:

Baseline comparison showing whether issue counts increased or decreased.
Release risk summary.
Actions needed before approval.

Using "when-auditing-security-use-security-analyzer". Audit dependencies and exposed secrets.

Expected outcome:

Dependency vulnerability summary from npm audit.
Potential credential matches found in local files.
Guidance to rotate secrets and update packages when needed.

Security Audit

Medium Risk

v10 • 7/9/2026 Open versioned report

The static matches are overwhelmingly scanner signatures, documentation examples, local temporary-file usage, or local audit commands rather than malicious behavior. I did not find evidence of credential exfiltration, destructive actions, prompt injection, or unauthorized remote targeting, but the skill does execute external tooling and can generate sensitive local reports. Static review was capped at 400/481 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Files scanned

3,524

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:52-65 slash-command-security-analyzer.sh:220-225

Unpinned External Package Execution

The workflow repeatedly invokes npx claude-flow@alpha. Running an alpha package through npx can execute code fetched from the package registry unless the user has pinned, audited, and approved that dependency.

The cited lines show direct npx execution of claude-flow@alpha in both documentation and the command script. This is a supply-chain and execution-safety concern, but it is transparent and related to the skill workflow rather than hidden malware.

Low

slash-command-security-analyzer.sh:379-403 slash-command-security-analyzer.sh:479-506

Security Reports May Contain Sensitive Findings

The analyzer writes matched secrets, dependency data, and source snippets into local temporary files and the output report. This is expected for a scanner, but reports must be treated as sensitive artifacts.

The script explicitly scans for credentials and includes findings in the generated report. There is no external upload shown, so the issue is local handling and disclosure risk.

Risk Factors

🌐 Network access (32)

⚡ Contains scripts (9)

PROCESS.md:141 PROCESS.md:138 PROCESS.md:150 SKILL.md:91 SKILL.md:441 SKILL.md:92 SKILL.md:92 SKILL.md:103 SKILL.md:90

⚙️ External commands (50)

PROCESS.md:94-103 PROCESS.md:359-385 PROCESS.md:385-410 PROCESS.md:410-411 PROCESS.md:411-432 PROCESS.md:432-436 PROCESS.md:436-458 PROCESS.md:458-460 PROCESS.md:460-488 PROCESS.md:507-521 PROCESS.md:521-532 PROCESS.md:50 PROCESS.md:259 PROCESS.md:260 PROCESS.md:262 PROCESS.md:263 PROCESS.md:264 PROCESS.md:265 PROCESS.md:267 PROCESS.md:274 PROCESS.md:286 PROCESS.md:546 PROCESS.md:560 README.md:284 README.md:288 README.md:104 README.md:283 SKILL.md:37-44 SKILL.md:44-52 SKILL.md:52-66 SKILL.md:66-69 SKILL.md:69-128 SKILL.md:128-131 SKILL.md:131-140 SKILL.md:140-148 SKILL.md:148-235 SKILL.md:235-251 SKILL.md:251-254 SKILL.md:254-261 SKILL.md:261-269 SKILL.md:269-306 SKILL.md:306-309 SKILL.md:309-322 SKILL.md:322-330 SKILL.md:330-394 SKILL.md:394-397 SKILL.md:397-405 SKILL.md:405-413 SKILL.md:413-570 SKILL.md:570-573

📁 Filesystem access (50)

🔑 Env variables (8)

PROCESS.md:243 PROCESS.md:243 SKILL.md:745 SKILL.md:745 SKILL.md:343 SKILL.md:745 SKILL.md:746 slash-command-security-analyzer.sh:389

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dnyoussef-when-auditing-security-use-security-analyzer/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-auditing-security-use-security-analyzer/security.svg)](https://skillstore.io/skills/dnyoussef-when-auditing-security-use-security-analyzer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dnyoussef-when-auditing-security-use-security-analyzer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-auditing-security-use-security-analyzer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-auditing-security-use-security-analyzer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DNYoussef. (2026). when-auditing-security-use-security-analyzer security audit report (audit version 10) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-auditing-security-use-security-analyzer/audits/10

BibTeX citation

@techreport{dnyoussef-dnyoussef-when-auditing-security-use-security-analyzer-2026,
  author = {DNYoussef},
  title = {when-auditing-security-use-security-analyzer security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/dnyoussef-when-auditing-security-use-security-analyzer/audits/10},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-auditing-security-use-security-analyzer security audit report (audit version 10)"
version: "1.0.0"
type: report
authors:
  - name: "DNYoussef"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/dnyoussef-when-auditing-security-use-security-analyzer/audits/10"
identifiers:
  - type: other
    value: "skillstore:dnyoussef-when-auditing-security-use-security-analyzer:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Pre-merge security review

Run a local scan before opening a pull request to catch common injection, secrets, and dependency issues.

Release readiness audit

Combine static checks, npm audit results, and OWASP scoring into one report before a release.

Security learning workflow

Use documented vulnerable and safe examples to teach teams how common web security issues appear in code.

Try These Prompts

Run a basic static scan

Use the security analyzer to run a static scan on this project and summarize the most important findings.

Check secrets and dependencies

Run secrets detection and dependency auditing, then tell me which findings need immediate action.

Compare against a baseline

Run the security analyzer against this codebase and compare the results with my existing baseline report.

Perform a full release audit

Run the full security analyzer workflow with strict mode, include OWASP coverage, and produce a prioritized remediation plan.

Best Practices

Run scans only on repositories and local services you are authorized to test.
Review each finding manually before treating it as a confirmed vulnerability.
Store generated reports securely because they can include sensitive file paths or code snippets.

Avoid

Do not run dynamic or rate-limit tests against third-party systems without written permission.
Do not paste generated reports into public tools when they contain secrets or internal paths.
Do not treat grep-based results as complete coverage for complex security issues.