skill-security-auditor
包含实用检测规则与审计工作流，适合安全评估与加固流程化。
需要访问代码库/基础设施权限，可能产生误报。
代码、配置与基础设施的安全审计流程与检测规则指南。
对代码、配置和基础设施做安全审计，能发现 SQL 注入、XSS、命令注入、路径遍历、硬编码密钥和依赖库中的 CVE 等问题并给出修复建议。常在发布前安全检查、合规审计或应急响应安全事件时用。特点是覆盖代码、依赖和配置三层，能产出可执行的检测规则和安全报告，便于落地整改。
▸ 展开 SKILL.md 英文原文
Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on "security audit", "vulnerability scan", "code review for security", "find secrets", "check for vulnerabilities", "OWASP", "CVE", or questions about code security.
帮我安装这个 skill：https://raw.githubusercontent.com/eigent-ai/eigent/main/resources/example-skills/skill-security-auditor/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/eigent-ai/eigent/main/resources/example-skills/skill-security-auditor/SKILL.md"# Security Auditor Guide ## Overview This guide covers security auditing workflows for source code, dependencies, and configurations. For detailed vulnerability patterns and detection rules, see references/vulnerability-patterns.md. For secrets detection patterns, see references/secrets-patterns.md. ## Quick Start Run the bundled scan script against a project directory: ```bash python scripts/scan_project.py /path/to/project ``` This performs a lightweight scan for common issues: hardcoded secrets, dangerous function calls, and insecure patterns. For deeper analysis, follow the workflows below. ### Testing the scripts ```bash python scripts/scan_project.py /path/to/some/project --for