Static Security Auditing Skill

This skill outlines how to check codebases for security vulnerabilities, exposed secrets, and unmasked environment variables.

Guidelines

1. Credential Sweep: Scan files for raw credentials or key strings using regex patterns or tools:

   grep -E "API_KEY|SECRET|PASSWORD" src/
   

2. Verify Shell Injection Safety: Inspect all usages of subprocess executions to ensure user inputs are never concatenated directly into shell strings (always use raw lists without shell=True).
3. Confirm Dependency Locks: Verify that lockfiles (package-lock.json, poetry.lock) exist and are validated against approved enterprise hash databases.