How do I install the Zero2ai Security Audit skill?

Run npx skillmds add modbender/zero2ai-security-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Zero2ai Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Zero2ai Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Zero2ai Security Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Zero2ai Security Audit?

modbender (@modbender) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Zero2ai Security Audit by modbender

Name: Zero2ai Security Audit
Rating: 4.5 (4 reviews)
Author: modbender

Zero2ai Security Audit

Security auditing for git commits, repos, and skills before publishing. Run automatically before any `git commit`, `git push`, or `clawhub publish`. Detects hardcoded secrets, API keys, tokens, absolute paths, committed node_modules, .env files, and other sensitive patterns. Use when reviewing code for security issues, pre-publishing skills, or investigating a potential secret exposure.

modbender ca9ebc5 2 files · 13.8 KB Updated Sep 9, 2026 12 repo stars

File contents

Security Audit

Run scripts/audit.py before every commit, push, or skill publish. No exceptions.

When to run

Trigger	Command
Before `git commit`	`python3 {skill_dir}/scripts/audit.py --staged`
Before `git push`	`python3 {skill_dir}/scripts/audit.py --last-commit`
Before `clawhub publish <path>`	`python3 {skill_dir}/scripts/audit.py <skill_path>`
Ad-hoc scan any path	`python3 {skill_dir}/scripts/audit.py <path>`

{skill_dir} = /home/aladdin/.openclaw/workspace/skills/skill-security-audit

Exit codes

0 = clean
1 = HIGH or MEDIUM findings (block publish/push)
2 = usage error

What it detects

Severity	Pattern
🔴 HIGH	API keys, secrets, passwords, JWT tokens, WooCommerce keys, AWS keys, private key blocks, bearer tokens, `.env` files
🟡 MEDIUM	Absolute `/home/<user>/` paths, `/root/` paths, refresh tokens, `node_modules/` committed
🔵 LOW	Hardcoded IPs, long base64 strings

Rules

HIGH findings = hard block. Never commit or publish with HIGH findings. Rotate any exposed secret immediately.
MEDIUM findings = fix before publish. Replace absolute paths with relative or env-var defaults. Remove node_modules/.
LOW findings = review. Not blocking but investigate.
False positives: If a match is a variable name or safe placeholder (not an actual value), document why it's safe in a comment and re-run.

After finding a real secret

Do NOT push the commit. If already pushed: rotate the secret immediately, then rewrite history or delete the file from git.
Rotate in the provider portal (TikTok Dev, AWS IAM, WooCommerce, etc.)
Move to env var: process.env.SECRET_NAME or read from a local config file outside the repo.
Add the config file path to .gitignore.
Report to Aladdin immediately with severity and what was exposed.

Skill publish checklist

Before clawhub publish:

audit.py <skill_path> returns 0 (clean)
node_modules/ not present in skill folder
No absolute paths to user home directories
No hardcoded business-specific IDs or credentials
package.json name matches skill folder name
SKILL.md description updated if renamed

---name: zero2ai-security-auditdescription: Security auditing for git commits, repos, and skills before publishing. Run automatically before any `git commit`, `git push`, or `clawhub publish`. Detects hardcoded secrets, API keys, tokens, absolute paths, committed node_modules, .env files, and other sensitive patterns. Use when reviewing code for security issues, pre-publishing skills, or investigating a potential secret exposure.--- # Security Audit Run `scripts/audit.py` before every commit, push, or skill publish. No exceptions. ## When to run | Trigger | Command | |---|---| | Before `git commit` | `python3 {skill_dir}/scripts/audit.py --staged` | | Before `git push` | `python3 {skill_dir}/scripts/audit.py --last-commit` | | Before `clawhub publish <path>` | `python3 {skill_dir}/scripts/audit.py <skill_path>` | | Ad-hoc scan any path | `python3 {skill_dir}/scripts/audit.py <path>` | `{skill_dir}` = `/home/aladdin/.openclaw/workspace/skills/skill-security-audit` ## Exit codes - `0` = clean - `1` = HIGH or MEDIUM findings (block publish/push) - `2` = usage error ## What it detects | Severity | Pattern | |---|---| | 🔴 HIGH | API keys, secrets, passwords, JWT tokens, WooCommerce keys, AWS keys, private key blocks, bearer tokens, `.env` files | | 🟡 MEDIUM | Absolute `/home/<user>/` paths, `/root/` paths, refresh tokens, `node_modules/` committed | | 🔵 LOW | Hardcoded IPs, long base64 strings | ## Rules 1. **HIGH findings = hard block.** Never commit or publish with HIGH findings. Rotate any exposed secret immediately. 2. **MEDIUM findings = fix before publish.** Replace absolute paths with relative or env-var defaults. Remove `node_modules/`. 3. **LOW findings = review.** Not blocking but investigate. 4. **False positives:** If a match is a variable name or safe placeholder (not an actual value), document why it's safe in a comment and re-run. ## After finding a real secret 1. **Do NOT push the commit.** If already pushed: rotate the secret immediately, then rewrite history or delete the file from git. 2. Rotate in the provider portal (TikTok Dev, AWS IAM, WooCommerce, etc.) 3. Move to env var: `process.env.SECRET_NAME` or read from a local config file outside the repo. 4. Add the config file path to `.gitignore`. 5. Report to Aladdin immediately with severity and what was exposed. ## Skill publish checklist Before `clawhub publish`: - [ ] `audit.py <skill_path>` returns 0 (clean) - [ ] `node_modules/` not present in skill folder - [ ] No absolute paths to user home directories - [ ] No hardcoded business-specific IDs or credentials - [ ] `package.json` name matches skill folder name - [ ] SKILL.md description updated if renamed

Frequently asked questions