Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →florianbruniaux/security
Rapid security assessment focused on OWASP Top 10 vulnerabilities
Passed 18 of 23 test cases with the skill, and 13 of 23 without it.
and 2 more in the full report
5 fixed13 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
If I want to run the security skill exclusively for package vulnerabilities without running static code regexes, what specific argument should I pass to the security tool?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies the deps argument subcommand invocation | Missed | Passed |
The instructions your model reads when the skill loads.
Rapid security assessment focused on OWASP Top 10 vulnerabilities.
Perform a quick security scan to identify common vulnerabilities:
# Common secret patterns
grep -rn --include="*.{js,ts,py,go,java,rb,php,env}" \
-E "(password|secret|api_key|apikey|token|auth|credential).*[=:].*['\"][^'\"]{8,}['\"]" \
--exclude-dir={node_modules,vendor,.git,dist,build} . 2>/dev/null | head -20
# .env files that might be committed
find . -name ".env*" -not -path "*/node_modules/*" -type f 2>/dev/null
# Check if secrets are gitignored
[ -f ".gitignore" ] && grep -q "\.env" .gitignore && echo "✅ .env in .gitignore" || echo "⚠️ .env NOT in .gitignore"
# SQL injection patterns (raw queries with string concat)
grep -rn --include="*.{js,ts,py,go,java,php}" \
-E "(query|execute|raw|sql).*\+.*\$|f['\"].*SELECT|\.format\(.*SELECT" \
--exclude-dir={node_modules,vendor,.git} . 2>/dev/null | head -15
# Command injection patterns
grep -rn --include="*.{js,ts,py,go,rb,php}" \
test cases passed, vs 13 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.