Skip to content
Get packs

Security Auditor

Scans code, configs and dependencies for vulnerabilities, hardcoded secrets and insecure defaults

Source Download skill
Repository
eigent-ai/eigent
Stars
15,719
Licence
Apache-2.0
Files
6 files

What it does

When installed, the agent gets a structured security-audit playbook for reviewing source code, configuration files and infrastructure. It knows common vulnerability classes (SQL injection, XSS, command injection, path traversal), OWASP Top 10 checks, and how to write a severity-ranked audit report. It can also run two bundled Python scripts that pattern-match a project folder for hardcoded secrets, risky function calls like eval or os.system, and insecure config values, then use the results in its review.

Great for

  • Developers who want a first-pass security review of their own project before release
  • Students or teams learning what common web and cloud security mistakes look like
  • Reviewers who want a consistent checklist and report template for security reviews

Skip it if

  • Production security sign-off: the scripts use simple pattern matching and will miss issues and report false positives, so a human security review or professional audit is still needed
  • Auditing projects you do not own or have no permission to examine, since the skill reads all files in a directory
  • Relying on dependency checks alone: the dependency commands depend on external tools (pip-audit, npm, govulncheck, Trivy) being installed and are not bundled

Try asking

  • “Run a security audit on this project and give me a severity-ranked report”
  • “Find any hardcoded API keys or database passwords in my repo”
  • “Review my Express login and session code for authorization problems”
  • “Check my requirements.txt and package.json for known CVEs”
Step-by-step guide: how to use Security AuditorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 6 original files, the Apache-2.0 licence and an attribution note.

    skill-security-auditor.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip skill-security-auditor.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip skill-security-auditor.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Point the scripts at a specific project folder rather than a home directory to limit what is read and to reduce noise
  • Treat script output as leads to verify manually, not as a final list of vulnerabilities
  • Review the scripts before running them, since the agent will execute them on your machine

What's inside

  • LICENSE.txt
  • references/secrets-patterns.md
  • references/vulnerability-patterns.md
  • scripts/scan_project.py
  • scripts/scan_secrets.py
  • SKILL.md

Redistributed unmodified from eigent-ai/eigent under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.