Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

code-vuln-audit · zebbern | DecimalAI

securityby zebbern

code-vuln-audit

zebbern/code-vuln-audit

Source zebbern/claude-code-guide ↗License MIT

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection.

SkillScore91Maintained

Automatic

Security & AppSec pack

Last verified 8/10/2026

What it changes

Passed 21 of 23 test cases with the skill, and 14 of 23 without it.

Without skill61%

With skill91%

Checks it passed that the model alone missed

Restricts scan mode to dependency scanning
Applies high minimum severity threshold filtering
States that 512 KB is the default maximum file size limit

and 8 more in the full report

7 fixed14 passed either way2 still failing0 broke

Pass-rate lift: +30 pp
Tokens: +16%
Agent turns: 0%
Response time: -59%

Model gemini-3.6-flashMeasured 8/10/2026v121 of 23 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/zebbern-code-vuln-audit/SKILL.md https://app.decimal.ai/s/zebbern-code-vuln-audit/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add zebbern-code-vuln-audit, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/zebbern-code-vuln-audit/ and pins it in .decimal/skills.lock

decimalai skills add zebbern-code-vuln-audit

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/zebbern-code-vuln-audit/SKILL.md https://app.decimal.ai/s/zebbern-code-vuln-audit/SKILL.md

Raw file: /s/zebbern-code-vuln-audit/SKILL.md ↗ · machine-readable summary at /s/zebbern-code-vuln-audit.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 7

Prompt

If `python3 scripts/security_scan.py` encounters an unhandled internal scanner error or runtime crash during execution, what specific exit code is emitted?

What was checked, without and with the skill
Checked	Without skill	With skill
States that exit code 2 indicates an internal scanner error	Missed	Passed

case-18 · gemini-3.6-flash · 8/10/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md146 lines2 filesincludes scripts

code-vuln-audit

A code security scanning tool with three core scanning capabilities:

Dependency Vulnerability Scanning — Automatically detects known vulnerabilities in npm / pip dependencies
Secret Leak Detection — Discovers hardcoded secrets, tokens, and passwords via regex matching + Shannon entropy analysis
OWASP Pattern Detection — Identifies common security anti-patterns such as SQL injection, XSS, command injection, and insecure deserialization

Quick Start

# Scan the current directory (all checks)
python3 scripts/security_scan.py .

# Scan dependencies only
python3 scripts/security_scan.py --mode deps .

# Detect secret leaks only
python3 scripts/security_scan.py --mode secrets /path/to/project

# Detect OWASP security patterns only
python3 scripts/security_scan.py --mode owasp .

# Output report in JSON format
python3 scripts/security_scan.py --format json --output report.json .

# Only show findings at high severity and above
python3 scripts/security_scan.py --severity high .

Scan Module Details

1. Dependency Vulnerability Scanning (deps)

Automatically detects the project type and invokes the appropriate tool:

Project Type	Detection File	Tool Used
Node.js	`package.json` + `package-lock.json`	`npm audit`
Python	`requirements.txt` / `pyproject.toml` / `Pipfile`	`pip-audit`

Track record

Benchmark

21 / 23

test cases passed, vs 14 / 23 without

Adoption

Users: 5
Times used: 152

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

zebbern / claude-code-guide

skills/code-vuln-audit/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 1 file · scripts

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

eigent-ai/skill-security-auditorSecurity auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on "security audit", "vulnerability scan", "code review for security", "find secrets", "check for vulnerabilities", "OWClose match+9 pp pass-rate lift

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

code-vuln-audit

Quick Start

Scan Module Details

1. Dependency Vulnerability Scanning (deps)

Track record

Benchmark

Adoption

SkillSafety

Source

Other skills for the same job

Related skills