skill-security-auditor

Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on "security audit", "vulnerability scan", "code review for security", "find secrets", "check for vulnerabilities", "OWASP", "CVE", or questions about code security.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured and highly actionable, with executable scripts, concrete code examples, and clean progressive disclosure to real reference files. The main weaknesses are minor verbosity in a few explanatory lines and the absence of an explicit finding-verification checkpoint in the workflow.

Suggestions

Trim self-evident statements like 'Critical and high severity findings should be addressed before deployment' and tighten the 'Key questions' list to assume Claude's competence.

Add an explicit validation/triage step in the workflow (e.g., review scan output, suppress likely false positives, confirm severity before writing the report) to introduce a feedback checkpoint.

Consider moving the full OWASP Top 10 table and language-specific dangerous/safe snippets into references/ to keep SKILL.md a leaner overview.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and actionable, but a few lines state what Claude already knows (e.g., 'Critical and high severity findings should be addressed before deployment') and the 'Key questions' checklist is slightly redundant, placing it at the 4 anchor rather than a lean 5.	4 / 5
Actionability	Provides copy-paste-ready commands (scan_project.py, pip audit, npm audit, govulncheck, trivy) and complete dangerous-vs-safe code examples for Python, JS, and Go, fully matching the 5 anchor.	5 / 5
Workflow Clarity	Six numbered audit phases give a clear sequence with a closing report format, but there is no explicit verification checkpoint (e.g., triaging false positives before reporting), leaving a minor validation gap at the 4 anchor.	4 / 5
Progressive Disclosure	SKILL.md is an overview with well-signaled one-level-deep references to references/vulnerability-patterns.md, references/secrets-patterns.md, and scripts/ — all real bundle files — with a Next Steps navigation section, matching the 5 anchor.	5 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong across all dimensions: it states concrete capabilities, provides natural trigger phrases, explicitly covers both what and when, and carves out a distinct security-auditing niche. It uses appropriate third-person voice throughout.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports' — with comprehensive coverage, matching the 5 anchor.	5 / 5
Completeness	Explicitly answers both what ('Security auditing for code, configs, and infrastructure' plus enumerated actions) and when ('Use when the user wants to audit or improve security' with concrete trigger phrases), matching the 5 anchor.	5 / 5
Trigger Term Quality	Includes natural user phrases and synonyms/acronyms — 'security audit', 'vulnerability scan', 'find secrets', 'check for vulnerabilities', 'OWASP', 'CVE' — matching the comprehensive 5 anchor.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear security-auditing niche with distinctive triggers (OWASP, CVE, vulnerability scan) and minimal overlap with general code-review skills, matching the 5 anchor.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: eigent-ai/eigent
Path: resources/example-skills/skill-security-auditor/SKILL.md
Commit: d308955

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.