{"owner":"eigent-ai","repo":"eigent","hasSkills":true,"hasMcp":false,"mcpConfig":null,"found":["resources/example-skills/skill-security-auditor/SKILL.md"],"skills":{"resources/example-skills/skill-security-auditor/SKILL.md":"---\nname: skill-security-auditor\ndescription: \"Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on \\\"security audit\\\", \\\"vulnerability scan\\\", \\\"code review for security\\\", \\\"find secrets\\\", \\\"check for vulnerabilities\\\", \\\"OWASP\\\", \\\"CVE\\\", or questions about code security.\"\nlicense: Complete terms in LICENSE.txt\n---\n\n# Security Auditor Guide\n\n## Overview\n\nThis guide covers security auditing workflows for source code, dependencies, and configurations. For detailed vulnerability patterns and detection rules, see references/vulnerability-patterns.md. For secrets detection patterns, see references/secrets-patterns.md.\n\n## Quick Start\n\nRun the bundled scan script against a project directory:\n\n```bash\npython scripts/scan_project.py /path/to/project\n```\n\nThis performs a lightweight scan for common issues: hardcoded secrets, dangerous function calls, and insecure patterns. For deeper analysis, follow the workflows below.\n\n### Testing the scripts\n\n```bash\npython scripts/scan_project.py /path/to/some/project --format text\npython scripts/scan_secrets.py /path/to/some/project --format text\n```\n\n## Audit Workflow\n\n### 1. Reconnaissance\n\nBefore auditing, understand the project:\n\n```bash\n# Identify languages, frameworks, and entry points\nfind . -type f -name \"*.py\" -o -name \"*.js\" -o -name \"*.ts\" -o -name \"*.go\" -o -name \"*.java\" | head -20\ncat package.json pyproject.toml requirements.txt go.mod pom.xml 2>/dev/null\n```\n\nKey questions:\n- What frameworks are used? (Express, Django, Flask, Spring, etc.)\n- Where are the entry points? (routes, controllers, API handlers)\n- How is authentication handled?\n- What external services are called?\n- Is user input accepted? Where?\n\n### 2. Secrets Detection\n\nScan for hardcoded credentials, API keys, and tokens. See references/secrets-patterns.md for the full pattern list.\n\n```bash\npython scripts/scan_secrets.py /path/to/project\n```\n\nCommon patterns to check:\n- API keys and tokens in source files\n- Database connection strings with embedded passwords\n- Private keys or certificates committed to the repo\n- `.env` files or config files with plaintext secrets\n- Secrets in CI/CD configuration files\n\n### 3. Vulnerability Scanning\n\n#### OWASP Top 10 Checklist\n\n| # | Category | What to Look For |\n|---|----------|-----------------|\n| A01 | Broken Access Control | Missing auth checks, IDOR, privilege escalation |\n| A02 | Cryptographic Failures | Weak algorithms, plaintext storage, missing TLS |\n| A03 | Injection | SQL, NoSQL, OS command, LDAP, XSS |\n| A04 | Insecure Design | Missing rate limits, business logic flaws |\n| A05 | Security Misconfiguration | Debug mode, default credentials, verbose errors |\n| A06 | Vulnerable Components | Outdated dependencies with known CVEs |\n| A07 | Auth Failures | Weak passwords, missing MFA, session issues |\n| A08 | Data Integrity Failures | Insecure deserialization, unsigned updates |\n| A09 | Logging Failures | Missing audit logs, sensitive data in logs |\n| A10 | SSRF | Unvalidated URLs in server-side requests |\n\n#### Language-Specific Checks\n\n**Python**\n```python\n# Dangerous: SQL injection\ncursor.execute(f\"SELECT * FROM users WHERE id = {user_id}\")\n# Safe: Parameterized query\ncursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))\n\n# Dangerous: Command injection\nos.system(f\"ping {hostname}\")\n# Safe: Use subprocess with list args\nsubprocess.run([\"ping\", hostname], capture_output=True)\n\n# Dangerous: Path traversal\nopen(f\"/data/{user_input}\")\n# Safe: Validate and resolve path\npath = pathlib.Path(\"/data\") / user_input\npath.resolve().relative_to(pathlib.Path(\"/data\").resolve())\n```\n\n**JavaScript/TypeScript**\n```javascript\n// Dangerous: XSS via innerHTML\nelement.innerHTML = userInput;\n// Safe: Use textContent or sanitize\nelement.textContent = userInput;\n\n// Dangerous: Prototype pollution\nObject.assign(target, JSON.parse(userInput));\n// Safe: Validate input structure\nconst parsed = JSON.parse(userInput);\nif (typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error();\nconst sanitized = Object.fromEntries(\n  Object.entries(parsed).filter(([k]) => !k.startsWith('__'))\n);\n\n// Dangerous: eval or Function constructor\neval(userInput);\n// Safe: Never use eval with user input\n```\n\n**Go**\n```go\n// Dangerous: SQL injection\ndb.Query(\"SELECT * FROM users WHERE id = \" + id)\n// Safe: Parameterized query\ndb.Query(\"SELECT * FROM users WHERE id = $1\", id)\n\n// Dangerous: Path traversal\nhttp.ServeFile(w, r, filepath.Join(baseDir, r.URL.Path))\n// Safe: Clean and validate path\ncleaned := filepath.Clean(r.URL.Path)\nfull := filepath.Join(baseDir, cleaned)\nif !strings.HasPrefix(full, baseDir) { http.Error(...) }\n```\n\n### 4. Dependency Audit\n\nCheck for known vulnerabilities in project dependencies:\n\n```bash\n# Python\npip audit\nsafety check -r requirements.txt\n\n# Node.js\nnpm audit\nnpx auditjs ossi\n\n# Go\ngovulncheck ./...\n\n# General (if Trivy is available)\ntrivy fs --scanners vuln /path/to/project\n```\n\nReview the output and categorize by severity (critical, high, medium, low). Critical and high severity findings should be addressed before deployment.\n\n### 5. Configuration Review\n\nCheck for insecure defaults in configuration files:\n\n```yaml\n# Common misconfigurations to flag:\nDEBUG: true                    # Debug mode in production\nALLOWED_HOSTS: [\"*\"]          # Unrestricted host access\nCORS_ALLOW_ALL_ORIGINS: true  # Open CORS policy\nSECRET_KEY: \"default\"         # Default or weak secret key\nSSL_VERIFY: false             # Disabled TLS verification\n```\n\nCheck infrastructure configs:\n- Dockerfiles: Running as root, exposing unnecessary ports\n- CI/CD: Secrets in plaintext, overly permissive permissions\n- Cloud configs: Public S3 buckets, open security groups\n\n### 6. Authentication and Authorization Review\n\nKey areas to verify:\n- Password hashing uses strong algorithms (bcrypt, argon2, scrypt)\n- Sessions have appropriate timeouts and rotation\n- JWT tokens are validated properly (algorithm, expiry, signature)\n- API endpoints enforce authorization checks\n- Role-based access control is consistently applied\n- Rate limiting is in place for login and sensitive endpoints\n\n## Report Format\n\nWhen generating a security audit report, use this structure:\n\n```markdown\n# Security Audit Report\n\n## Summary\n- **Project**: [name]\n- **Date**: [date]\n- **Scope**: [what was audited]\n- **Risk Level**: [Critical/High/Medium/Low]\n\n## Findings\n\n### [SEVERITY] Finding Title\n- **Category**: [OWASP category]\n- **Location**: [file:line]\n- **Description**: [what the issue is]\n- **Impact**: [what could happen if exploited]\n- **Recommendation**: [how to fix]\n\n## Statistics\n- Total findings: [count]\n- Critical: [count] | High: [count] | Medium: [count] | Low: [count]\n```\n\n## Next Steps\n\n- For detailed vulnerability patterns and code examples, see references/vulnerability-patterns.md\n- For secrets detection regex patterns, see references/secrets-patterns.md\n"},"files":{"resources/example-skills/skill-security-auditor/SKILL.md":"---\nname: skill-security-auditor\ndescription: \"Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on \\\"security audit\\\", \\\"vulnerability scan\\\", \\\"code review for security\\\", \\\"find secrets\\\", \\\"check for vulnerabilities\\\", \\\"OWASP\\\", \\\"CVE\\\", or questions about code security.\"\nlicense: Complete terms in LICENSE.txt\n---\n\n# Security Auditor Guide\n\n## Overview\n\nThis guide covers security auditing workflows for source code, dependencies, and configurations. For detailed vulnerability patterns and detection rules, see references/vulnerability-patterns.md. For secrets detection patterns, see references/secrets-patterns.md.\n\n## Quick Start\n\nRun the bundled scan script against a project directory:\n\n```bash\npython scripts/scan_project.py /path/to/project\n```\n\nThis performs a lightweight scan for common issues: hardcoded secrets, dangerous function calls, and insecure patterns. For deeper analysis, follow the workflows below.\n\n### Testing the scripts\n\n```bash\npython scripts/scan_project.py /path/to/some/project --format text\npython scripts/scan_secrets.py /path/to/some/project --format text\n```\n\n## Audit Workflow\n\n### 1. Reconnaissance\n\nBefore auditing, understand the project:\n\n```bash\n# Identify languages, frameworks, and entry points\nfind . -type f -name \"*.py\" -o -name \"*.js\" -o -name \"*.ts\" -o -name \"*.go\" -o -name \"*.java\" | head -20\ncat package.json pyproject.toml requirements.txt go.mod pom.xml 2>/dev/null\n```\n\nKey questions:\n- What frameworks are used? (Express, Django, Flask, Spring, etc.)\n- Where are the entry points? (routes, controllers, API handlers)\n- How is authentication handled?\n- What external services are called?\n- Is user input accepted? Where?\n\n### 2. Secrets Detection\n\nScan for hardcoded credentials, API keys, and tokens. See references/secrets-patterns.md for the full pattern list.\n\n```bash\npython scripts/scan_secrets.py /path/to/project\n```\n\nCommon patterns to check:\n- API keys and tokens in source files\n- Database connection strings with embedded passwords\n- Private keys or certificates committed to the repo\n- `.env` files or config files with plaintext secrets\n- Secrets in CI/CD configuration files\n\n### 3. Vulnerability Scanning\n\n#### OWASP Top 10 Checklist\n\n| # | Category | What to Look For |\n|---|----------|-----------------|\n| A01 | Broken Access Control | Missing auth checks, IDOR, privilege escalation |\n| A02 | Cryptographic Failures | Weak algorithms, plaintext storage, missing TLS |\n| A03 | Injection | SQL, NoSQL, OS command, LDAP, XSS |\n| A04 | Insecure Design | Missing rate limits, business logic flaws |\n| A05 | Security Misconfiguration | Debug mode, default credentials, verbose errors |\n| A06 | Vulnerable Components | Outdated dependencies with known CVEs |\n| A07 | Auth Failures | Weak passwords, missing MFA, session issues |\n| A08 | Data Integrity Failures | Insecure deserialization, unsigned updates |\n| A09 | Logging Failures | Missing audit logs, sensitive data in logs |\n| A10 | SSRF | Unvalidated URLs in server-side requests |\n\n#### Language-Specific Checks\n\n**Python**\n```python\n# Dangerous: SQL injection\ncursor.execute(f\"SELECT * FROM users WHERE id = {user_id}\")\n# Safe: Parameterized query\ncursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))\n\n# Dangerous: Command injection\nos.system(f\"ping {hostname}\")\n# Safe: Use subprocess with list args\nsubprocess.run([\"ping\", hostname], capture_output=True)\n\n# Dangerous: Path traversal\nopen(f\"/data/{user_input}\")\n# Safe: Validate and resolve path\npath = pathlib.Path(\"/data\") / user_input\npath.resolve().relative_to(pathlib.Path(\"/data\").resolve())\n```\n\n**JavaScript/TypeScript**\n```javascript\n// Dangerous: XSS via innerHTML\nelement.innerHTML = userInput;\n// Safe: Use textContent or sanitize\nelement.textContent = userInput;\n\n// Dangerous: Prototype pollution\nObject.assign(target, JSON.parse(userInput));\n// Safe: Validate input structure\nconst parsed = JSON.parse(userInput);\nif (typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error();\nconst sanitized = Object.fromEntries(\n  Object.entries(parsed).filter(([k]) => !k.startsWith('__'))\n);\n\n// Dangerous: eval or Function constructor\neval(userInput);\n// Safe: Never use eval with user input\n```\n\n**Go**\n```go\n// Dangerous: SQL injection\ndb.Query(\"SELECT * FROM users WHERE id = \" + id)\n// Safe: Parameterized query\ndb.Query(\"SELECT * FROM users WHERE id = $1\", id)\n\n// Dangerous: Path traversal\nhttp.ServeFile(w, r, filepath.Join(baseDir, r.URL.Path))\n// Safe: Clean and validate path\ncleaned := filepath.Clean(r.URL.Path)\nfull := filepath.Join(baseDir, cleaned)\nif !strings.HasPrefix(full, baseDir) { http.Error(...) }\n```\n\n### 4. Dependency Audit\n\nCheck for known vulnerabilities in project dependencies:\n\n```bash\n# Python\npip audit\nsafety check -r requirements.txt\n\n# Node.js\nnpm audit\nnpx auditjs ossi\n\n# Go\ngovulncheck ./...\n\n# General (if Trivy is available)\ntrivy fs --scanners vuln /path/to/project\n```\n\nReview the output and categorize by severity (critical, high, medium, low). Critical and high severity findings should be addressed before deployment.\n\n### 5. Configuration Review\n\nCheck for insecure defaults in configuration files:\n\n```yaml\n# Common misconfigurations to flag:\nDEBUG: true                    # Debug mode in production\nALLOWED_HOSTS: [\"*\"]          # Unrestricted host access\nCORS_ALLOW_ALL_ORIGINS: true  # Open CORS policy\nSECRET_KEY: \"default\"         # Default or weak secret key\nSSL_VERIFY: false             # Disabled TLS verification\n```\n\nCheck infrastructure configs:\n- Dockerfiles: Running as root, exposing unnecessary ports\n- CI/CD: Secrets in plaintext, overly permissive permissions\n- Cloud configs: Public S3 buckets, open security groups\n\n### 6. Authentication and Authorization Review\n\nKey areas to verify:\n- Password hashing uses strong algorithms (bcrypt, argon2, scrypt)\n- Sessions have appropriate timeouts and rotation\n- JWT tokens are validated properly (algorithm, expiry, signature)\n- API endpoints enforce authorization checks\n- Role-based access control is consistently applied\n- Rate limiting is in place for login and sensitive endpoints\n\n## Report Format\n\nWhen generating a security audit report, use this structure:\n\n```markdown\n# Security Audit Report\n\n## Summary\n- **Project**: [name]\n- **Date**: [date]\n- **Scope**: [what was audited]\n- **Risk Level**: [Critical/High/Medium/Low]\n\n## Findings\n\n### [SEVERITY] Finding Title\n- **Category**: [OWASP category]\n- **Location**: [file:line]\n- **Description**: [what the issue is]\n- **Impact**: [what could happen if exploited]\n- **Recommendation**: [how to fix]\n\n## Statistics\n- Total findings: [count]\n- Critical: [count] | High: [count] | Medium: [count] | Low: [count]\n```\n\n## Next Steps\n\n- For detailed vulnerability patterns and code examples, see references/vulnerability-patterns.md\n- For secrets detection regex patterns, see references/secrets-patterns.md\n"},"items":[{"name":"SKILL.md","path":"resources/example-skills/skill-security-auditor/SKILL.md","title":"skill-security-auditor Skill","content":"---\nname: skill-security-auditor\ndescription: \"Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on \\\"security audit\\\", \\\"vulnerability scan\\\", \\\"code review for security\\\", \\\"find secrets\\\", \\\"check for vulnerabilities\\\", \\\"OWASP\\\", \\\"CVE\\\", or questions about code security.\"\nlicense: Complete terms in LICENSE.txt\n---\n\n# Security Auditor Guide\n\n## Overview\n\nThis guide covers security auditing workflows for source code, dependencies, and configurations. For detailed vulnerability patterns and detection rules, see references/vulnerability-patterns.md. For secrets detection patterns, see references/secrets-patterns.md.\n\n## Quick Start\n\nRun the bundled scan script against a project directory:\n\n```bash\npython scripts/scan_project.py /path/to/project\n```\n\nThis performs a lightweight scan for common issues: hardcoded secrets, dangerous function calls, and insecure patterns. For deeper analysis, follow the workflows below.\n\n### Testing the scripts\n\n```bash\npython scripts/scan_project.py /path/to/some/project --format text\npython scripts/scan_secrets.py /path/to/some/project --format text\n```\n\n## Audit Workflow\n\n### 1. Reconnaissance\n\nBefore auditing, understand the project:\n\n```bash\n# Identify languages, frameworks, and entry points\nfind . -type f -name \"*.py\" -o -name \"*.js\" -o -name \"*.ts\" -o -name \"*.go\" -o -name \"*.java\" | head -20\ncat package.json pyproject.toml requirements.txt go.mod pom.xml 2>/dev/null\n```\n\nKey questions:\n- What frameworks are used? (Express, Django, Flask, Spring, etc.)\n- Where are the entry points? (routes, controllers, API handlers)\n- How is authentication handled?\n- What external services are called?\n- Is user input accepted? Where?\n\n### 2. Secrets Detection\n\nScan for hardcoded credentials, API keys, and tokens. See references/secrets-patterns.md for the full pattern list.\n\n```bash\npython scripts/scan_secrets.py /path/to/project\n```\n\nCommon patterns to check:\n- API keys and tokens in source files\n- Database connection strings with embedded passwords\n- Private keys or certificates committed to the repo\n- `.env` files or config files with plaintext secrets\n- Secrets in CI/CD configuration files\n\n### 3. Vulnerability Scanning\n\n#### OWASP Top 10 Checklist\n\n| # | Category | What to Look For |\n|---|----------|-----------------|\n| A01 | Broken Access Control | Missing auth checks, IDOR, privilege escalation |\n| A02 | Cryptographic Failures | Weak algorithms, plaintext storage, missing TLS |\n| A03 | Injection | SQL, NoSQL, OS command, LDAP, XSS |\n| A04 | Insecure Design | Missing rate limits, business logic flaws |\n| A05 | Security Misconfiguration | Debug mode, default credentials, verbose errors |\n| A06 | Vulnerable Components | Outdated dependencies with known CVEs |\n| A07 | Auth Failures | Weak passwords, missing MFA, session issues |\n| A08 | Data Integrity Failures | Insecure deserialization, unsigned updates |\n| A09 | Logging Failures | Missing audit logs, sensitive data in logs |\n| A10 | SSRF | Unvalidated URLs in server-side requests |\n\n#### Language-Specific Checks\n\n**Python**\n```python\n# Dangerous: SQL injection\ncursor.execute(f\"SELECT * FROM users WHERE id = {user_id}\")\n# Safe: Parameterized query\ncursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))\n\n# Dangerous: Command injection\nos.system(f\"ping {hostname}\")\n# Safe: Use subprocess with list args\nsubprocess.run([\"ping\", hostname], capture_output=True)\n\n# Dangerous: Path traversal\nopen(f\"/data/{user_input}\")\n# Safe: Validate and resolve path\npath = pathlib.Path(\"/data\") / user_input\npath.resolve().relative_to(pathlib.Path(\"/data\").resolve())\n```\n\n**JavaScript/TypeScript**\n```javascript\n// Dangerous: XSS via innerHTML\nelement.innerHTML = userInput;\n// Safe: Use textContent or sanitize\nelement.textContent = userInput;\n\n// Dangerous: Prototype pollution\nObject.assign(target, JSON.parse(userInput));\n// Safe: Validate input structure\nconst parsed = JSON.parse(userInput);\nif (typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error();\nconst sanitized = Object.fromEntries(\n  Object.entries(parsed).filter(([k]) => !k.startsWith('__'))\n);\n\n// Dangerous: eval or Function constructor\neval(userInput);\n// Safe: Never use eval with user input\n```\n\n**Go**\n```go\n// Dangerous: SQL injection\ndb.Query(\"SELECT * FROM users WHERE id = \" + id)\n// Safe: Parameterized query\ndb.Query(\"SELECT * FROM users WHERE id = $1\", id)\n\n// Dangerous: Path traversal\nhttp.ServeFile(w, r, filepath.Join(baseDir, r.URL.Path))\n// Safe: Clean and validate path\ncleaned := filepath.Clean(r.URL.Path)\nfull := filepath.Join(baseDir, cleaned)\nif !strings.HasPrefix(full, baseDir) { http.Error(...) }\n```\n\n### 4. Dependency Audit\n\nCheck for known vulnerabilities in project dependencies:\n\n```bash\n# Python\npip audit\nsafety check -r requirements.txt\n\n# Node.js\nnpm audit\nnpx auditjs ossi\n\n# Go\ngovulncheck ./...\n\n# General (if Trivy is available)\ntrivy fs --scanners vuln /path/to/project\n```\n\nReview the output and categorize by severity (critical, high, medium, low). Critical and high severity findings should be addressed before deployment.\n\n### 5. Configuration Review\n\nCheck for insecure defaults in configuration files:\n\n```yaml\n# Common misconfigurations to flag:\nDEBUG: true                    # Debug mode in production\nALLOWED_HOSTS: [\"*\"]          # Unrestricted host access\nCORS_ALLOW_ALL_ORIGINS: true  # Open CORS policy\nSECRET_KEY: \"default\"         # Default or weak secret key\nSSL_VERIFY: false             # Disabled TLS verification\n```\n\nCheck infrastructure configs:\n- Dockerfiles: Running as root, exposing unnecessary ports\n- CI/CD: Secrets in plaintext, overly permissive permissions\n- Cloud configs: Public S3 buckets, open security groups\n\n### 6. Authentication and Authorization Review\n\nKey areas to verify:\n- Password hashing uses strong algorithms (bcrypt, argon2, scrypt)\n- Sessions have appropriate timeouts and rotation\n- JWT tokens are validated properly (algorithm, expiry, signature)\n- API endpoints enforce authorization checks\n- Role-based access control is consistently applied\n- Rate limiting is in place for login and sensitive endpoints\n\n## Report Format\n\nWhen generating a security audit report, use this structure:\n\n```markdown\n# Security Audit Report\n\n## Summary\n- **Project**: [name]\n- **Date**: [date]\n- **Scope**: [what was audited]\n- **Risk Level**: [Critical/High/Medium/Low]\n\n## Findings\n\n### [SEVERITY] Finding Title\n- **Category**: [OWASP category]\n- **Location**: [file:line]\n- **Description**: [what the issue is]\n- **Impact**: [what could happen if exploited]\n- **Recommendation**: [how to fix]\n\n## Statistics\n- Total findings: [count]\n- Critical: [count] | High: [count] | Medium: [count] | Low: [count]\n```\n\n## Next Steps\n\n- For detailed vulnerability patterns and code examples, see references/vulnerability-patterns.md\n- For secrets detection regex patterns, see references/secrets-patterns.md\n","category":"resources","tokens":1804}]}