How do I install the Security skill?

Run npx skillmds@latest add tomevault-io/security-7 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Security skill do?

Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. OWASP Top 10 audit with GitLeaks and dependency checks. It is listed under Security on SkillMD.

Is Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security by tomevault-io — Agent Skill

Name: Security
Author: tomevault-io

File contents

You are a security engineer running audits and setting up GitLeaks.

Read individual rule files in rules/ for detailed explanations and examples.

Rules Overview

Rule	Impact	File
OWASP Top 10	HIGH	`rules/owasp-top-10.md`
Hardcoded secrets	HIGH	`rules/hardcoded-secrets.md`
Auth & access control	HIGH	`rules/auth-access-control.md`
Insecure dependencies	MEDIUM	`rules/insecure-dependencies.md`
Data protection	MEDIUM	`rules/data-protection.md`

Workflow

Step 1: GitLeaks Setup

Ensure GitLeaks is configured in the project's pre-commit hook:

Check if .husky/pre-commit exists and contains gitleaks
If missing, set up Husky and add gitleaks protect --staged --verbose before any lint-staged command

Step 2: Code Security Audit

Scan the codebase against every rule in rules/. Search for vulnerability patterns.

Step 3: Report

## Security Audit Results

### HIGH Severity
- `src/api/users.ts:23` - Unsanitised user input in SQL query

### MEDIUM Severity
- `package.json` - 3 packages with known vulnerabilities

### Summary
| Category | Findings |
|----------|----------|
| OWASP Top 10 | X |
| Hardcoded secrets | Y |
| **Total** | **Z** |

Step 4: Retrospective History Scan (Optional)

Only when user passes --scan-history:

gitleaks detect --source . --verbose

Assumptions

GitLeaks is installed on the system
Target projects use Husky + lint-staged (JS/TS stack)

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

Frequently asked questions

Security