security-auditlisted

Comprehensive polyglot security audit across 60+ frameworks. Runs SARIF scanners and 12 parallel deep-dive categories (auth, injection, crypto, secrets, supply-chain, MCP/agentic, collection-scoping/BOLA, and more), computes severity over composed attack paths, and emits OWASP-tagged results. Use for 'run security audit', 'security audit', 'audit security', or arguments such as 'mode: delta', 'scope: services/api', 'categories: crypto,mitm,secrets', and 'output: docs/security-audit-output'. Every run must first create .claude-audit/current, write each phase artifact and phase-NN.done marker, emit SARIF 2.1.0 with security-severity and CWE on every result, emit a CycloneDX SBOM, then write the human report last. A report without the machine-readable blackboard is invalid.
velimattiv/claude-security-audit · ★ 0 · AI & Automation · score 68

Install: claude install-skill velimattiv/claude-security-audit

# Supported harnesses This is one open-standard Agent Skill for Claude Code and GitHub Copilot CLI. Use the active harness's tool names through the adapter in `workflow.md §5`; the artifact and security contracts are identical on both. # Mandatory contract before you do anything else This skill produces **two kinds of output** on every run. Both are required: 1. **Machine-readable blackboard artifacts** under `.claude-audit/current/`: - `phase-00-profile.json` … `phase-08-baseline.json` (per-phase artifacts) - `phase-NN.done` saga markers (one per completed phase) - `findings.sarif` (SARIF 2.1.0) - `findings.cyclonedx.json` (SBOM skeleton) 2. **A human-readable Markdown report** plus deliverable copies under the resolved **output directory** (default `docs/security-audit-output/`): `security-audit-report.md`, `findings.sarif`, `findings.cyclonedx.json`, and the pruned `security-audit-baseline.json`. The skill asks you where to write these on first run (honors an `output:` arg and a persisted choice; defaults non-interactively). See [lib/output-routing.md](lib/output-routing.md). ⛔ **Neither kind of output may contain a credential.** Both enforcers are mandatory and neither is optional hardening: - `phase-04-scanners.md §4.4b` — run [lib/redact-scanner-output.py](lib/redact-scanner-output.py) over `phase-04-scanners/` the moment the scanners finish, before anything reads them. `gitleaks detect --no-git` deliberately ignores `.gitignore`,