Security Audit Codebase

Name: Security Audit Codebase
Author: pjt222

Listed

pjt222·vlatest·security·MIT

Helps with security, auditing as part of implementing security and authentication workflows.

Repository

Install on your platform

Showing Claude Code. One command installs this skill into any of the agents below.

Run this in your project

terminal

$ npx skills add pjt222/agent-almanac --skill security-audit-codebase -a claude-code

Uses the open-source skills CLI and needs Node.js. Add -g to install it for your user instead of this project.

What we know about this skill

Publisher

pjt222

Taken from the source listing. We haven't verified who controls this account.

Install target

Live repository

Not pinned. Installing fetches whatever the repository holds at the time you run the command.

No human has reviewed this code. The checks below are a static scan of the files at one commit — nobody has run this skill or judged whether it works. A skill runs with whatever access you give your agent, so read the source before you install it.

Automated safety checks

scanned 30 Sept 2026

This skill failed 1 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.

Declares what it does: failed
No SKILL.md was found in the skill's directory.
SKILL.md exists, its frontmatter parses, and it declares a name and a description.
No undeclared network calls: passed
Makes no network calls.
Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.
No obfuscated payloads: passed
No encoded or obfuscated payloads.
No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.
No credential access: passed
Reads no keys, tokens, keychains or credential files.
Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.
No pipe-to-shell installers: passed
No pipe-to-shell or download-and-run installers.
No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.
Pinned to a commit: passed
Scanned pjt222/development-guides at bcca822c1c.
The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit: bcca822c1c
Manifest: skills/security-audit-codebase/SKILL.md
Scanned: 0 files
Copies in repo: 3 — all of them scanned

This is a static scan, not a review. It reads the skill's files; it does not run them, and it cannot tell you whether the skill is any good or whether the code does what its description says. A skill runs with whatever access you give your agent.

What each check looks for →

About this skill

What it does

This skill analyzes a codebase to identify potential security vulnerabilities. It performs static analysis, looking for common coding errors and weaknesses that could be exploited. The tool provides detailed reports highlighting these issues with suggested remediation steps.

When to use it

Before deploying new code: Ensure your application is secure before releasing it to production.
During code reviews: Integrate into the review process to proactively identify vulnerabilities.
After a security incident: Assess the impact and identify root causes within affected code.
For legacy codebase modernization: Understand existing risks during refactoring efforts.

Key capabilities

Static code analysis
Vulnerability identification
Detailed reporting with remediation suggestions

Example prompts

"Analyze this Python script for security vulnerabilities: [script content]"
"Perform a security audit of the authentication module in my Java project."
"Find potential SQL injection flaws in this PHP code snippet: [code snippet]"

Tips & gotchas

The accuracy of the analysis depends on the quality and complexity of the codebase. It's recommended to review the reports carefully, as false positives can occur.