How do I install the Common Security Audit skill?

Run npx skillmds@latest add comeonoliver/common-security-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Common Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Common Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Common Security Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Common Security Audit?

ComeOnOliver (@comeonoliver) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Common Security Audit by comeonoliver

Name: Common Security Audit
Rating: 4.2 (5 reviews)
Author: ComeOnOliver

Common Security Audit

Adversarial security probing and vulnerability assessments across Node, Go, Dart, Java, Python, and Rust. (triggers: package.json, go.mod, pubspec.yaml, pom.xml, Dockerfile, security audit, vulnerability scan, secrets detection, injection probe, pentest)

ComeOnOliver Updated Sep 8, 2026 61 repo stars

File contents

Security Audit

Priority: P0 (CRITICAL)

📋 Security Probing Protocol

1. Hardcoded Secrets (Critical)

Scan for plain-text keys, passwords, and tokens in code.

grep -riE "(password|apiKey|api_key|secret|private_key|token)\s*=\s*['\"][^'\"]{6,}" \
  . --exclude-dir={node_modules,dist,build,.git} -l

2. Data Leakage in Logs (PII/Secrets)

Identify sensitive info printed to logs or stdout.

Node/TS: grep -rE "console\.(log|error|warn)" . --include="*.ts" --include="*.js" | grep -iE "password|token|secret|private"
Go: grep -rE "log\.(Print|Printf|Println|Fatal)" . --include="*.go" | grep -iE "password|token|secret"
Dart/Flutter: grep -rE "print\(|debugPrint\(" . --include="*.dart" | grep -iE "password|token|secret"
Java/Spring: grep -rE "log(ger)?\.(info|debug|warn|error)" . --include="*.java" | grep -iE "password|token|secret"

3. Injection Surface (SQL / Command)

Detect raw string concatenation in queries or system commands.

grep -rE "\+.*SELECT|\+.*INSERT|\+.*UPDATE|\+.*DELETE|query\(.*\+|fmt\.Sprintf.*SELECT" \
  . --include="*.ts" --include="*.js" --include="*.go" --include="*.java" --include="*.py"

4. Auth Coverage vs Exposure

Compare total routes vs protected endpoints.

NestJS: total=$(grep -r "@(Get|Post|Put|Delete|Patch)" . | wc -l); guarded=$(grep -r "@(UseGuards|Auth)" . | wc -l)
Spring: total=$(grep -r "@(GetMapping|PostMapping|PutMapping)" . | wc -l); guarded=$(grep -r "@(PreAuthorize|Secured)" . | wc -l)
Go: total=$(grep -rE "(GET|POST|PUT|DELETE)" . | wc -l); guarded=$(grep -rE "(middleware|auth|jwt|guard)" . | wc -l)

5. Dependency Audit (CVE Scan)

Node: npm audit --audit-level=high
Dart/Flutter: dart pub outdated --json
Go: go list -m -u all | grep "\["
Java: mvn dependency:list or ./gradlew dependencies
Python: pip-audit
Rust: cargo audit

6. Infrastructure Hardening

grep -rE "^FROM .+:latest|^USER root|curl.*sh.*|ADD http" . --include="Dockerfile"

⚖️ Scoring Impact

Finding	Threshold	Severity	Deduction
Hardcoded Secrets	Any match	🔴 P0	-25
Plain-text PII in Logs	Any match	🔴 P0	-20
Unguarded Routes > 20%	> 0.2	🔴 P0	-15
Raw SQL Concatenation	Any match	🟠 P1	-10
Response Leakage (Stack)	> 0	🟠 P1	-10

[!CAUTION] A 🔴 P0 finding immediately caps the Security score at 40/100.

📚 Reference Links

Vulnerability Remediation Protocols

🚫 Anti-Patterns

Do NOT use standard patterns if specific project rules exist.
Do NOT ignore error handling or edge cases.

---name: common-security-auditdescription: Adversarial security probing and vulnerability assessments across Node, Go, Dart, Java, Python, and Rust. (triggers: package.json, go.mod, pubspec.yaml, pom.xml, Dockerfile, security audit, vulnerability scan, secrets detection, injection probe, pentest)---# Security Audit## **Priority: P0 (CRITICAL)**## 📋 Security Probing Protocol### 1. Hardcoded Secrets (Critical)Scan for plain-text keys, passwords, and tokens in code.```bashgrep -riE "(password|apiKey|api_key|secret|private_key|token)\s*=\s*['\"][^'\"]{6,}" \ . --exclude-dir={node_modules,dist,build,.git} -l```### 2. Data Leakage in Logs (PII/Secrets)Identify sensitive info printed to logs or stdout.- **Node/TS**: `grep -rE "console\.(log|error|warn)" . --include="*.ts" --include="*.js" | grep -iE "password|token|secret|private"`- **Go**: `grep -rE "log\.(Print|Printf|Println|Fatal)" . --include="*.go" | grep -iE "password|token|secret"`- **Dart/Flutter**: `grep -rE "print\(|debugPrint\(" . --include="*.dart" | grep -iE "password|token|secret"`- **Java/Spring**: `grep -rE "log(ger)?\.(info|debug|warn|error)" . --include="*.java" | grep -iE "password|token|secret"`### 3. Injection Surface (SQL / Command)Detect raw string concatenation in queries or system commands.```bashgrep -rE "\+.*SELECT|\+.*INSERT|\+.*UPDATE|\+.*DELETE|query\(.*\+|fmt\.Sprintf.*SELECT" \ . --include="*.ts" --include="*.js" --include="*.go" --include="*.java" --include="*.py"```### 4. Auth Coverage vs ExposureCompare total routes vs protected endpoints.- **NestJS**: `total=$(grep -r "@(Get|Post|Put|Delete|Patch)" . | wc -l); guarded=$(grep -r "@(UseGuards|Auth)" . | wc -l)`- **Spring**: `total=$(grep -r "@(GetMapping|PostMapping|PutMapping)" . | wc -l); guarded=$(grep -r "@(PreAuthorize|Secured)" . | wc -l)`- **Go**: `total=$(grep -rE "(GET|POST|PUT|DELETE)" . | wc -l); guarded=$(grep -rE "(middleware|auth|jwt|guard)" . | wc -l)`### 5. Dependency Audit (CVE Scan)- **Node**: `npm audit --audit-level=high`- **Dart/Flutter**: `dart pub outdated --json`- **Go**: `go list -m -u all | grep "\["`- **Java**: `mvn dependency:list` or `./gradlew dependencies`- **Python**: `pip-audit`- **Rust**: `cargo audit`### 6. Infrastructure Hardening```bashgrep -rE "^FROM .+:latest|^USER root|curl.*sh.*|ADD http" . --include="Dockerfile"```## ⚖️ Scoring Impact| Finding | Threshold | Severity | Deduction || ---------------------------- | --------- | -------- | --------- || **Hardcoded Secrets** | Any match | 🔴 P0 | -25 || **Plain-text PII in Logs** | Any match | 🔴 P0 | -20 || **Unguarded Routes > 20%** | > 0.2 | 🔴 P0 | -15 || **Raw SQL Concatenation** | Any match | 🟠 P1 | -10 || **Response Leakage (Stack)** | > 0 | 🟠 P1 | -10 |> [!CAUTION]> A **🔴 P0 finding** immediately caps the Security score at **40/100**.## 📚 Reference Links- [Vulnerability Remediation Protocols](references/REMEDIATION.md)## 🚫 Anti-Patterns- Do NOT use standard patterns if specific project rules exist.- Do NOT ignore error handling or edge cases.

Frequently asked questions