security-audit

Security Audit Skill

Runs a deterministic heuristic scan over a codebase to flag high-confidence security risks — committed secrets, disabled TLS verification, insecure deserialization, and shell-injection sinks — then optionally layers LLM reasoning (OWASP/STRIDE) on top of the machine findings. This is a lightweight heuristic audit assistant, not a pentest, a SAST replacement, or a proof of security: it is a regex line-scanner that cannot follow data flow and will miss anything outside its rules. Treat its output as triage leads for human review, never as assurance.

When to Use

• Before opening a PR that touches auth, secrets handling, deserialization, or external calls.
• As a fast pre-commit sweep for accidentally committed credentials.
• When reviewing an unfamiliar contribution and you want a cheap first pass.
• To produce a persisted, idempotent report that diffs cleanly across runs.
• Paired with derive-security-from-risk (which works forward, producing requirements) — this skill is the reverse, scanning existing code.
• NOT as the only security gate, and NOT as evidence that code is secure (see Pitfalls).

Prerequisites

• The powershell Copilot tool to invoke the scanner.
• Python 3 on PATH (the scan logic is one stdlib core; the .sh/.ps1 are thin wrappers).
• Read access to the target tree.

How to Run

Use the powershell tool to scan a directory and review the findings:

# High-confidence sweep of the repo (exit 1 = findings at/above --fail-on)
bash skills/security-audit/scripts/security-audit.sh . --suggest

# Broader (noisier) profile, fail only on medium-or-higher
bash skills/security-audit/scripts/security-audit.sh src --profile broad --fail-on medium

# Persist a deterministic JSON report for diffing
bash skills/security-audit/scripts/security-audit.sh . --format json --output audit.json

On Windows, call the parity wrapper security-audit.ps1 with the same arguments. Exit codes: 0 clean (below --fail-on), 1 findings at/above it, 2 usage error.