# Security Audit

> Use when checking for dependency vulnerabilities, accidentally committed secrets, or security issues in Docker images.

- Skill: `mrciphersmith/security-audit` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add mrciphersmith/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mrciphersmith/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: MrCipherSmith (https://skillmd.com/u/mrciphersmith)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mrciphersmith/security-audit

---


# Security Audit

## Purpose

Comprehensive security audit covering dependency vulnerabilities, secrets in code/git history, and container image scanning. Produces a prioritized remediation report.

**Input:** None (scans current project)
**Output:** Severity-grouped vulnerability report with remediation steps

## When to Use

- Before a release
- After adding new dependencies
- Periodic security review

## Steps

### Step 1 — Dependency vulnerabilities
Auto-detect: `bun.lockb` → `bun audit` | `package-lock.json` → `npm audit --json` | `yarn.lock` → `yarn audit`

Group by severity: **critical → high → moderate → low**

### Step 2 — Outdated packages
Run `bun outdated` or `npm outdated`. Flag packages more than 2 major versions behind.

### Step 3 — Secrets scan
- Check git history for `.env`, `.key`, `.pem` files
- Grep source for hardcoded passwords/API keys/secrets (excluding node_modules)

### Step 4 — Docker image scan
If Dockerfile present and Docker available: `docker scout cves`

### Report
- Total by severity
- Top 3 critical/high with CVE
- Recommended immediate actions
- Packages safe to ignore (dev-only, not reachable in prod)

## Rules

- Distinguish prod vs dev-only vulnerabilities
- Never suggest `npm audit fix --force` without explaining what it changes