ai-security
Performs unified security auditing for SAST, dependencies, and secrets.
Install
mkdir -p .claude/skills/ai-security && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/12506" && unzip -o skill.zip -d .claude/skills/ai-security && rm skill.zipInstalls to .claude/skills/ai-security
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Runs security gates: SAST with OWASP/CWE mapping, dependency vulnerability scans, secret detection, SBOM generation for compliance, pre-release security verdict. Trigger for 'is this secure', 'audit dependencies', 'check for secrets', 'security report', 'is this package safe', 'compliance review'. Not for governance process; use /ai-governance instead. Not for runtime payload inspection; use prompt-injection-guard hook instead.Key capabilities
- →Perform static application security testing (SAST)
- →Conduct dependency vulnerability scans
- →Detect secrets in codebases
- →Generate Software Bill of Materials (SBOM)
- →Auto-remediate security findings
How it works
This skill runs various security tools like Semgrep, Gitleaks, and Pip-audit to perform static analysis, dependency scanning, and secret detection on a codebase.
Inputs & outputs
When to use ai-security
- →Security audit
- →Check for secrets
- →Dependency scan
About ai-security
Runs security gates including static analysis, vulnerability scans, and secret leak checks. Generates SBOMs and reports for compliance.
Runs security gates: SAST with OWASP/CWE mapping, dependency vulnerability scans, secret detection, SBOM generation for compliance, pre-release security verdict. Trigger for 'is this secure', 'audit dependencies', 'check for secrets', 'security report', 'is this package safe', 'compliance review'. N
When not to use it
- →For governance process
- →For runtime payload inspection
- →For code quality metrics
Prerequisites
Limitations
- →Not for governance process
- →Not for runtime payload inspection
- →Not for code quality metrics
How it compares
This workflow provides a unified security assessment using multiple specialized tools, unlike manual code reviews or single-tool scans.
Compared to similar skills
ai-security side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| ai-security (this skill) | 0 | 2mo | No flags | Intermediate |
| dependency-auditor | 1 | 9mo | Review | Beginner |
| repo-security-posture | 0 | 1mo | Review | Advanced |
| ship-safe | 0 | 1mo | Review | Beginner |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by arcasilesgroup
View all by arcasilesgroup →You might also like
dependency-auditor
alirezarezvani
Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.
repo-security-posture
superagent-ai
Audit a GitHub repository's security posture and hardening gaps across branch protection, CODEOWNERS, GitHub Actions, publish/release integrity, collaborator access, security features, and dependency review. Use when reviewing or hardening a repo, assessing GitHub configuration, checking CI/CD or Ac
ship-safe
kinncj
Run ship-safe security and quality audit on the current project. Executes npx ship-safe audit . and reports findings by severity. Use before shipping any feature or PR.
go-vuln-remediate
infobloxopen
Run Wiz-based vulnerability scan and automatic Go module remediation for containerized Go services in the konk repository. Use when you need to build images, scan CVEs, patch vulnerable dependencies in go.mod/go.sum across konk-service and konk-provision modules, validate builds, and prepare a PR su
security-before-push
antonsmedberg
Use before commit, push, or PR to check secrets, generated junk, unsafe permissions, logging leaks, and durable instruction changes.
security-compliance
RicherTunes
Establish comprehensive security scanning and compliance infrastructure from scratch. Use when working with security audits, vulnerability scanning, secret detection, CodeQL, Dependabot, or security hardening. Critical priority for Qobuzarr.