# Security Vulnerability Audit

> Workflow for auditing security vulnerabilities using Trunk (Trivy and OSV-scanner). Use when checking for project vulnerabilities, hard-coded secrets, or repairing security flaws. Use when this capability is needed.

- Skill: `tomevault-io/security-vulnerability-audit` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/security-vulnerability-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-vulnerability-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/security-vulnerability-audit

---


# Security Vulnerability Audit

This skill provides a structured process for identifying and reporting security vulnerabilities in the codebase using Trunk's integrated security tools.

## Audit Workflow

1. **Run Security Scan**: Execute the project's security linting script.

   ```bash
   pnpm run lint:security
   ```

   _Note: This command runs `trunk check --all --scope security`, which triggers both Trivy and OSV-scanner._

2. **Analyze Findings**: Review the output from Trunk. Pay close attention to:
   - **Critical/High** vulnerabilities in dependencies (reported by `osv-scanner`).
   - **Hard-coded secrets** or configuration issues (reported by `trivy`).

3. **Compile Report**: Use the findings to create a summary of the security posture.

## Reporting Format

For each significant finding, provide:

- **Severity**: [Critical/High/Medium/Low]
- **Tool**: [Trivy/OSV-Scanner]
- **Description**: [Brief description of the vulnerability]
- **Impact**: [What happens if exploited?]
- **Recommendation**: [How to fix it, e.g., "Update package X to version Y"]

## Resources

- [Security Tools Reference](../common-references/security-tools.md): Detailed information on the tools and how to interpret their results.
- [Trunk Documentation](https://docs.trunk.io/): Official documentation for the Trunk CLI.

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/yu-iskw) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-13 -->