skill-security-auditor

Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on "security audit", "vulnerability scan", "code review for security", "find secrets", "check for vulnerabilities", "OWASP", "CVE", or questions about code security.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, concise, and highly actionable skill body that leverages real reference and script files appropriately. Its only notable gap is the absence of explicit validation/feedback-loop checkpoints in the audit workflow, which caps workflow clarity.

Suggestions

Add explicit validation or verification checkpoints to the audit workflow (e.g., after running a scan script, instruct Claude to confirm findings against the referenced patterns and re-run with --format text if output is malformed), since these are batch operations that benefit from feedback loops.

Insert a brief triage/confirm step between scanning and reporting — for example, categorize each finding by severity and verify the location (file:line) before writing it into the report — to give the workflow a clear error-recovery loop.

Clarify what to do when a scan script returns no results (e.g., proceed to the next workflow stage or note a clean finding) so the sequence has an explicit decision point rather than an implicit one.

Dimension	Reasoning	Score
Conciseness	The body is lean and action-oriented — commands, dangerous/safe code pairs, a checklist table, and a report template — with almost no explanation of concepts Claude already knows; it earns its tokens rather than padding, matching the lean-and-efficient anchor over the could-be-tightened score-2 case.	3 / 3
Actionability	Provides fully executable commands (scan scripts, pip/npm audit, govulncheck, trivy) and concrete dangerous/safe code examples plus a copy-paste report template, matching the executable-and-copy-paste-ready anchor rather than the pseudocode score-2 case.	3 / 3
Workflow Clarity	The 6-step sequence (Reconnaissance → Secrets → Vulnerabilities → Dependencies → Config → Auth) is clear, but for batch-scan and destructive-adjacent operations it lacks explicit validation checkpoints or feedback loops, which the rubric caps at 2 rather than the score-3 explicit-validation anchor.	2 / 3
Progressive Disclosure	SKILL.md is an overview with well-signaled, one-level-deep references to real bundle files (references/vulnerability-patterns.md, references/secrets-patterns.md, and the scan scripts), with detailed patterns split out rather than inlined, matching the clear-overview-with-signaled-references anchor.	3 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely enumerates auditing capabilities, provides explicit 'Use when' and 'Trigger on' guidance, and uses natural trigger terms with low conflict risk. No significant weaknesses.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions such as 'scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults', matching the multiple-specific-actions anchor rather than the partial score-2 example.	3 / 3
Completeness	Explicitly states both what it does (the auditing actions) and when to use it via 'Use when the user wants to audit or improve security' plus an explicit 'Trigger on' clause, satisfying the both-what-and-when anchor rather than the implied-when score-2 case.	3 / 3
Trigger Term Quality	Includes natural terms a user would say — 'security audit', 'vulnerability scan', 'code review for security', 'find secrets', 'check for vulnerabilities', 'OWASP', 'CVE' — giving broad coverage rather than the missing-variations score-2 case.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear security-auditing niche with distinctive triggers like 'OWASP', 'CVE', and 'find secrets', making misfiring for unrelated skills unlikely; above the still-overlapping score-2 anchor.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: eigent-ai/eigent
Path: resources/example-skills/skill-security-auditor/SKILL.md
Commit: 9d0a169

Reviewed: about 11 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.