Agent Skills › XiaomingX/mimofan › security-audit

security-audit

GitHub

用于对代码仓库进行结构化安全审计，涵盖静态分析、依赖漏洞扫描及污点追踪。在用户请求安全审查、发现漏洞或发布敏感代码前使用，提供证据优先的审计报告。

crates/tui/assets/skills/security-audit/SKILL.md XiaomingX/mimofan

Trigger Scenarios

用户要求审计仓库或查找漏洞发布涉及外部输入或密钥的代码前

Install

npx skills add XiaomingX/mimofan --skill security-audit -g -y

More Options

Non-standard path

npx skills add https://github.com/XiaomingX/mimofan/tree/main/crates/tui/assets/skills/security-audit -g -y

Use without installing

npx skills use XiaomingX/mimofan@security-audit

指定 Agent (Claude Code)

npx skills add XiaomingX/mimofan --skill security-audit -a claude-code -g -y

安装 repo 全部 skill

npx skills add XiaomingX/mimofan --all -g -y

预览 repo 内 skill

npx skills add XiaomingX/mimofan --list

SKILL.md

Frontmatter

{
    "name": "security-audit",
    "metadata": {
        "short-description": "Security audit via semgrep, OSV, and taint analysis"
    },
    "description": "Run a structured security audit of the current workspace — SAST via semgrep (SARIF), dependency\/OSV advisories, and taint\/gadget-chain review. Use when the user asks for a security review, wants to find vulnerabilities, or before shipping sensitive code."
}

Security Audit

Use this skill to drive a thorough, evidence-first security review of a workspace. Prefer automated signals over eyeballing.

When to use

The user asks "audit this repo", "find vulnerabilities", "security review".
Before shipping code that handles external input, secrets, or serialization.
As the analysis step of /code-review when the security persona is active.

Workflow

Static SAST with semgrep. Produce SARIF so the reviewer can normalize it into security_issues:
```
semgrep --config auto --sarif --output semgrep.sarif .
```
If semgrep is unavailable, fall back to the bundled rule presets and the static analyzer's taint engine. Never claim a clean bill of health you didn't actually verify.
Dependency / OSV scan. Parse the lockfile (Cargo.lock, package-lock.json) and cross-check against the OSV advisory database; prune to reachable dependencies only.
Gadget-chain & knowledge-base check. Enumerate attack surface: which known gadget chains (Log4Shell, C3P0, Commons-Collections, Fastjson autoType) are satisfiable given the resolved dependencies.
Taint review. For each source→sink path the analyzer reports, confirm the evidence chain and whether a sanitizer (strong or partial) breaks it.
Report. Emit one security_issues entry per confirmed finding with severity, category, title, description, path, line, and the rule_id / evidence chain. Separate confirmed from suspected. Name the tool that produced each signal.

Safety

Audit is read-only. Do not auto-fix unless the user explicitly asks; if you do, run the test suite and be ready to roll back.
Do not exfiltrate secrets you find. Report their location; redact values.
Treat semgrep configs and third-party rules as untrusted input.