← All skills
code-security-auditor
75 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By LeoYeAI/agent-master-skills (GitHub) · security · 2,186 stars · scanned at commit 8f88f9a
Comprehensive code security audit with AI-powered vulnerability detection. Covers OWASP Top 10, dependency scanning, secret detection, SAST, and provides actionable fix recommendations. Use when security review, penetration testing, or compliance audit is needed.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 13 places.
Show 10 more
- skills/code-security-auditor/README.md, line 40
npm install -g npm-audit - skills/code-security-auditor/README.md, line 43
pip install truffleHog - skills/code-security-auditor/README.md, line 45
go install github.com/zricethezav/gitleaks/v8@latest - skills/code-security-auditor/SKILL.md, line 57
pipx run pip-audit --format json - skills/code-security-auditor/SKILL.md, line 61
npx audit-ci --config audit-ci.jsonc - skills/code-security-auditor/SKILL.md, line 690
- pip install code-security-auditor - skills/code-security-auditor/auditor.py, line 154
'code': f"pip install {dep}>={vuln.get('fixed_in', 'latest')}" - skills/code-security-auditor/references/owasp-top10.md, line 469
pip install pip-audit safety - skills/code-security-auditor/references/owasp-top10.md, line 470
npm install -g npm-audit - skills/code-security-auditor/references/owasp-top10.md, line 491
- pip install pip-audit safety
Connects to the internet
The author does not mention this. Expected for a security skill.
Found in 20 places.
Show 17 more
- skills/code-security-auditor/SKILL.md, line 178
urllib.request.urlopen(user_input) # ❌ - skills/code-security-auditor/SKILL.md, line 185
return requests.get(url) - skills/code-security-auditor/SKILL.md, line 421
return requests.get(url) - skills/code-security-auditor/SKILL.md, line 450
return requests.get(url, allow_redirects=False) - skills/code-security-auditor/auditor.py, line 96
(r'urllib\.request\.urlopen\s*\([^)]*\b(url|uri)\b', 'user input in urlopen'), - skills/code-security-auditor/auditor.py, line 98
(r'axios\.(get|post)\s*\([^)]*\b(url|uri|endpoint)\b', 'user input in axios'), - skills/code-security-auditor/llm_integration.py, line 197
response = requests.post(url, json=payload, timeout=self.config.timeout) - skills/code-security-auditor/llm_integration.py, line 228
response = requests.post(url, json=payload, headers=headers, timeout=self.config.timeout) - skills/code-security-auditor/llm_integration.py, line 252
response = requests.post(url, json=payload, headers=headers, timeout=self.config.timeout) - skills/code-security-auditor/references/owasp-top10.md, line 268
requests.get(user_url) - skills/code-security-auditor/references/owasp-top10.md, line 439
return requests.get(url, allow_redirects=False, **kwargs) - skills/code-security-auditor/rules/extended-rules.md, line 258
| A10-001 | requests 无验证 | `requests.get(url)` | CRITICAL | - skills/code-security-auditor/rules/extended-rules.md, line 259
| A10-002 | urllib 无验证 | `urlopen(url)` | CRITICAL | - skills/code-security-auditor/rules/extended-rules.md, line 260
| A10-003 | fetch 无验证 | `fetch(url)` | HIGH | - skills/code-security-auditor/rules/extended-rules.md, line 261
| A10-004 | axios 无验证 | `axios.get(url)` | HIGH | - skills/code-security-auditor/test_vulnerable.py, line 28
return requests.get(url) - skills/code-security-auditor/test_vulnerable.py, line 88
return requests.get(url, allow_redirects=False)
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 14 places.
Show 11 more
- skills/code-security-auditor/SKILL.md, line 269
chmod 600 .env # ✅ - skills/code-security-auditor/SKILL.md, line 747
code-security-auditor quick ./src - skills/code-security-auditor/auditor.py, line 118
result = subprocess.run( - skills/code-security-auditor/auditor.py, line 126
except subprocess.TimeoutExpired: - skills/code-security-auditor/auditor.py, line 377
'code': 'subprocess.run(["command", "arg1", "arg2"], check=True)' - skills/code-security-auditor/references/owasp-top10.md, line 89
os.system(f"ping {user_input}") - skills/code-security-auditor/references/owasp-top10.md, line 92
subprocess.run(['ping', user_input], check=True) - skills/code-security-auditor/rules/extended-rules.md, line 78
| A03-005 | 命令注入 os.system | `os.system(f"cmd {var}")` | CRITICAL | - skills/code-security-auditor/rules/extended-rules.md, line 79
| A03-006 | 命令注入 subprocess | `subprocess.call(var, shell=True)` | CRITICAL | - skills/code-security-auditor/test_vulnerable.py, line 40
os.system(f"ping -c 4 {host}") - skills/code-security-auditor/test_vulnerable.py, line 102
subprocess.run(['ping', '-c', '4', host], check=True)
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'code-security-auditor' ] || [ -L ~/.agents/skills/'code-security-auditor' ]; then echo 'A skill folder named code-security-auditor already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/LeoYeAI/agent-master-skills' "$d" && git -C "$d" checkout --quiet '8f88f9a0dd5a1075d4f0c7626f9d960844d57575' -- 'skills/code-security-auditor' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/code-security-auditor' ~/.agents/skills/'code-security-auditor' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'code-security-auditor' ~/.claude/skills/'code-security-auditor' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for LeoYeAI/agent-master-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/LeoYeAI/agent-master-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | 8f88f9a | 75 |
| 2026-11-07 | 8f88f9a | 65 |