Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →alirezarezvani/security-auditor
Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns.
Passed 19 of 22 test cases with the skill, and 17 of 22 without it.
and 1 more in the full report
3 fixed16 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Review this Express route handler where database queries are built dynamically: `const q = 'SELECT * FROM accounts WHERE owner_id = ' + req.query.owner; db.query(q);`. Format a security finding for file `server/db.js` line 14.
| Checked | Without skill | With skill |
|---|---|---|
| The output identifies the vulnerability as a CRITICAL severity SQL injection | Missed | Passed |
| The output recommends using parameterized queries with placeholders instead of string concatenation | Missed | Passed |
The instructions your model reads when the skill loads.
Automatic security vulnerability detection.
1. SQL Injection
// CRITICAL: SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;
// SECURE: Parameterized query
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [userId]);
2. XSS (Cross-Site Scripting)
// CRITICAL: XSS vulnerability
element.innerHTML = userInput;
// SECURE: Use textContent or sanitize
element.textContent = userInput;
// or
element.innerHTML = DOMPurify.sanitize(userInput);
3. Authentication Issues
// CRITICAL: Weak JWT secret
test cases passed, vs 17 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.