Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →shadd0wtaka/security-review-audit-skill
Workflows für PR-Review, Security-Audit, Log-Analyse, Testing, Compliance.
Passed 18 of 24 test cases with the skill, and 12 of 24 without it.
and 4 more in the full report
7 fixed11 passed either way5 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
We need to run a quick standalone vulnerability scan against our web application at `http://localhost:3000` using OWASP ZAP in CLI mode. What command executes this scan in self-contained mode?
| Checked | Without skill | With skill |
|---|---|---|
| zap-cli quick-scan --self-contained http://localhost:3000 | Missed | Passed |
The instructions your model reads when the skill loads.
Workflows für PR-Review, Security-Audit, Log-Analyse, Testing, Compliance.
# Dependency Scan
trivy fs --severity CRITICAL,HIGH --exit-code 1 ./app
# Secret Scan
trufflehog filesystem --no-verification .
gitleaks detect --source . --verbose
# SAST
semgrep --config=auto --error
# License Check
license-checker --failOn GPL --production
- [ ] Hardcoded secrets/API-Keys? → gitleaks scan
- [ ] SQL Injection? → Präparierte Statements statt String-Concatenation
- [ ] XSS? → Output escaped, CSP Header gesetzt
- [ ] IDOR? → Authorization-Check pro Resource
- [ ] Rate Limiting? → pro Endpoint/User/IP
- [ ] Dependency vulnerabel? → trivy/npm audit
- [ ] Logs enthalten Secrets? → Kein logging von Passwörtern/Tokens
- [ ] HTTPS only? → HSTS Header, Redirect
# Failed logins
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head
# Port scans
grep "SYN" /var/log/syslog | awk '{print $NF}' | sort -u
# API Errors
test cases passed, vs 12 / 24 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.