# Security Vulnerability Audit

> Workflow for auditing security vulnerabilities using Trunk (Trivy and OSV-scanner). Use when checking for project vulnerabilities, hard-coded secrets, or repairing security flaws.

- Skill: `majiayu000/security-vulnerability-audit` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-vulnerability-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-vulnerability-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-vulnerability-audit

---


# Security Vulnerability Audit

This skill provides a structured process for identifying and reporting security vulnerabilities in the codebase using Trunk's integrated security tools.

## Audit Workflow

1. **Run Security Scan**: Execute the project's security linting script.

   ```bash
   pnpm run lint:security
   ```

   _Note: This command runs `trunk check --all --scope security`, which triggers both Trivy and OSV-scanner._

2. **Analyze Findings**: Review the output from Trunk. Pay close attention to:
   - **Critical/High** vulnerabilities in dependencies (reported by `osv-scanner`).
   - **Hard-coded secrets** or configuration issues (reported by `trivy`).

3. **Compile Report**: Use the findings to create a summary of the security posture.

## Reporting Format

For each significant finding, provide:

- **Severity**: [Critical/High/Medium/Low]
- **Tool**: [Trivy/OSV-Scanner]
- **Description**: [Brief description of the vulnerability]
- **Impact**: [What happens if exploited?]
- **Recommendation**: [How to fix it, e.g., "Update package X to version Y"]

## Resources

- [Security Tools Reference](../common-references/security-tools.md): Detailed information on the tools and how to interpret their results.
- [Trunk Documentation](https://docs.trunk.io/): Official documentation for the Trunk CLI.