verify-security

Security Verification

Purpose

Verify code for security anti-patterns and vulnerabilities. All analysis happens locally—code never leaves your machine.

When to Use

Trigger this skill when the user asks to:

• "verify agent security"
• "verify security"
• "check for secrets"
• "scan for vulnerabilities"
• "security audit"

Note: For full verification including patterns, quality, and language-specific checks, tell the user to say "verify agent".

Process

Step 1: Discover Files

Locate files to analyze:

Configuration files:

• package.json, pyproject.toml, Cargo.toml - Dependencies
• .env, .env.example, .env.local - Environment files
• config.py, settings.py, config.ts - Configuration

Source files:

• *.py, *.ts, *.js, *.go, *.rs - Source code
• Prioritize files with: auth, api, client, secret, config in name

Exclude:

• node_modules/, .venv/, venv/, __pycache__/
• *.test.*, *.spec.*, *_test.go

Step 2: Run Security Checks

Check Tiers

• [PATTERN] — Mechanical check. Apply exactly as written.
• [HEURISTIC] — Judgment required. Mark findings clearly.

Tag every finding with [P] for pattern or [H] for heuristic.

---

2.1 [PATTERN] Hardcoded Secrets

Scan for assignments matching these patterns (case-insensitive):

Variable pattern	Fail condition
API_KEY	Assigned to string literal
SECRET	Assigned to string literal
PASSWORD	Assigned to string literal
TOKEN	Assigned to string literal
PRIVATE_KEY	Assigned to string literal
AWS_ACCESS_KEY_ID	Assigned to string literal
AWS_SECRET_ACCESS_KEY	Assigned to string literal

Examples of failures:

# ❌ Issue
API_KEY = "sk-abc123..."
password = "hunter2"
OPENAI_API_KEY = "sk-proj-..."

# ✅ Pass
API_KEY = os.environ["API_KEY"]
password = os.getenv("PASSWORD")
api_key = settings.API_KEY

Also flag:

• String literals matching known API key patterns:
  • sk-... (OpenAI)
  • sk-ant-... (Anthropic)
  • AKIA... (AWS)
  • ghp_... (GitHub)
  • xoxb-... (Slack)