New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Security Audit

by blueberrycongee in blueberrycongee/termcanvas

Security audit skill. An agent skill from blueberrycongee/termcanvas.

MITAuto-check: notesSecurity

Install Security Audit

skills CLI
$ npx skills add blueberrycongee/termcanvas --skill security-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install blueberrycongee/termcanvas security-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/blueberrycongee/termcanvas.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/skills/security-audit .claude/skills/security-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security-audit
GitHub stars
406
Token cost
~966 tokens
SKILL.md length
489 words
Files
1
Skills in repo
7
Repo updated
First seen
Licence
MIT

At a glance

Security audit skill. An agent skill from blueberrycongee/termcanvas.

  • Works in 8 steps: Scope → Input Validation → Auth and Session → …
  • Asked to audit security
  • SKILL.md covers Phase 1: Scope, Phase 2: Input Validation, Phase 3: Auth and Session and Phase 4: Secrets, plus 5 more sections
  • Calls git, npm and pip

What it does

Security Audit is an agent skill from blueberrycongee/termcanvas. Security audit skill. Use when asked to "audit security", "check for vulnerabilities", "security review", "pentest", or when evaluating code that handles auth, user input, secrets, or external data. Runs a phased scan covering OWASP Top 10 and STRIDE threat modeling.

Its SKILL.md is about 970 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Security review and Threat modeling. It works with Git. The repository describes itself as: An infinite canvas desktop app for visually managing terminals. The licence is MIT.

When your agent uses it

  • Asked to audit security
  • Check for vulnerabilities
  • Security review
  • Evaluating code that handles auth

Example prompts

  • “audit security”
  • “check for vulnerabilities”
  • “security review”
  • “/security-audit”

Workflow steps

8 steps, taken from the step headings in SKILL.md.

  1. Scope
  2. Input Validation
  3. Auth and Session
  4. Secrets
  5. Dependencies
  6. CI/CD
  7. STRIDE Threat Model
  8. Report

What it can do on your machine

Read from SKILL.md and the folder at commit fa25981. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git
    • npm
    • pip

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git, npm and pip, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Audit loads about 966 tokens when it runs. Until then it costs about 71 tokens; SKILL.md has 489 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~71
When it runs · the whole SKILL.md, loaded when a task matches
~966

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:49
    3. Verify `.gitignore` covers `.env`, credential files, and key material

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from blueberrycongee/termcanvas at commit fa25981, republished under its MIT licence (© blueberrycongee). 489 words, ~966 tokens.

Download SKILL.mdSave it as .claude/skills/security-audit/SKILL.md (or your agent's skills folder).
name
security-audit
description
Security audit skill. Use when asked to "audit security", "check for vulnerabilities", "security review", "pentest", or when evaluating code that handles auth, user input, secrets, or external data. Runs a phased scan covering OWASP Top 10 and STRIDE threat modeling.

Security Audit

Phased security scan. Each phase is independent — skip phases that do not apply to the codebase.

Phase 1: Scope

  1. Identify the attack surface: what accepts external input? (HTTP endpoints, CLI args, file uploads, WebSocket messages, IPC, environment variables)
  2. Identify trust boundaries: where does data cross from untrusted to trusted?
  3. List authentication and authorization mechanisms in use
  4. Note the deployment model (server, serverless, desktop, CLI)

Phase 2: Input Validation

For each entry point identified in Phase 1:

  • Is user input validated and sanitized before use?
  • Are SQL queries parameterized (not string-interpolated)?
  • Is HTML output escaped to prevent XSS?
  • Are file paths validated to prevent path traversal?
  • Are file uploads constrained by type and size?
  • Is deserialization of untrusted data avoided or sandboxed?

Phase 3: Auth and Session

  • Are all protected routes/endpoints checked for authentication?
  • Is authorization checked per-resource, not just per-route?
  • Are session tokens generated with sufficient entropy?
  • Are tokens stored securely (httpOnly, secure, sameSite)?
  • Is there rate limiting on login/auth endpoints?
  • Are password reset flows safe from enumeration?

Phase 4: Secrets

  1. grep -r for common secret patterns in source (API keys, tokens, passwords, connection strings) — exclude node_modules, .git, lock files
  2. Check git log --all -p -S "password\|secret\|api_key\|token" for secrets that were committed and later removed (they are still in history)
  3. Verify .gitignore covers .env, credential files, and key material
  4. Check that secrets are not logged, included in error responses, or exposed in client-side bundles

Phase 5: Dependencies

  1. Check for known vulnerabilities: npm audit / pip audit / equivalent
  2. Look for unmaintained dependencies (no updates in 2+ years)
  3. Check that lockfiles are committed and dependencies are pinned
Show full SKILL.md (212 more words)Show less

Phase 6: CI/CD

If CI/CD config exists (.github/workflows/, .gitlab-ci.yml, etc.):

  • Are third-party actions/images pinned to SHA, not floating tags?
  • Does pull_request_target grant write access to untrusted PRs?
  • Are secrets available only to the workflows that need them?
  • Can a malicious PR modify CI config to exfiltrate secrets?

Phase 7: STRIDE Threat Model

For each component identified in Phase 1, evaluate:

  • Spoofing — Can an attacker impersonate a legitimate user or service?
  • Tampering — Can data be modified in transit or at rest without detection?
  • Repudiation — Are security-relevant actions logged with enough detail for audit?
  • Information Disclosure — Can sensitive data leak through errors, logs, or side channels?
  • Denial of Service — Are there unbounded operations an attacker can trigger?
  • Elevation of Privilege — Can a low-privilege user reach admin functionality?

Phase 8: Report

For each finding:

  1. Severity: Critical / High / Medium / Low / Informational
  2. Location: file path and line range
  3. Description: what the vulnerability is
  4. Impact: what an attacker could do
  5. Recommendation: specific fix, not generic advice

Rules

  • Only report findings you can point to in the code — no hypotheticals
  • If a finding requires a specific runtime condition to exploit, state the condition
  • Do not report style issues, linting violations, or non-security code quality as security findings
  • Distinguish between confirmed vulnerabilities and potential risks

© blueberrycongee, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/skills/security-audit of blueberrycongee/termcanvas.

Open the folder on GitHubat commit fa25981

Compare with similar skills

Security Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security Audit compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security Audit this skillblueberrycongee/termcanvas406—~966Automated safety check: NotesMIT
Commit Security Scancodexstar69/bug-hunter519—~629Automated safety check: PassMIT
Securitynotque/vexjoy-agent438—~2.6kAutomated safety check: NotesMIT
Repo SentinelMathews-Tom/armory328—~2.2kAutomated safety check: PassMIT
Security Ownership Mapdiegosouzapw/awesome-omni-skills159—~4.6kAutomated safety check: PassApache-2.0
Security Reviewdanielvm-git/bigpowers257—~1.5kAutomated safety check: PassMIT

Similar skills

  • Commit Security Scan

    codexstar69/bug-hunter

    Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.

    519 GitHub stars~629 tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Security

    notque/vexjoy-agent

    Security: review git changes for vulnerabilities, threat-model a system's attack surface, audit supply-chain risks.

    438 GitHub stars~2.6k tokensUpdated 5 days ago
    SecurityAuto-check: notes

  • Repo Sentinel

    Mathews-Tom/armory

    Full security audit for public repositories across 12 attack surfaces: git history, secrets, CI/CD, containers, dependencies, licenses.

    328 GitHub stars~2.2k tokensUpdated 2 days ago
    SecurityAuto-check passed

  • Security Ownership Map

    diegosouzapw/awesome-omni-skills

    Security Ownership Map workflow skill. An agent skill from diegosouzapw/awesome-omni-skills.

    159 GitHub stars~4.6k tokensUpdated 3 mo ago
    SecurityAuto-check passed

  • Security Review

    danielvm-git/bigpowers

    AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files.

    257 GitHub stars~1.5k tokensUpdated 17 days ago
    SecurityAuto-check passed

  • Cc Review

    doccker/cc-use-exp

    结构化代码审查工作流，适用于显式 quick/full/security review；不负责普通实现或 bug 修复流程。

    1.1k GitHub stars~541 tokensUpdated 1 mo ago
    SecurityAuto-check passed

More from blueberrycongee/termcanvas

  • Challenge

    blueberrycongee/termcanvas

    Adversarial review skill. An agent skill from blueberrycongee/termcanvas.

    406 GitHub stars~1.5k tokensUpdated 4 mo ago
    Auto-check passed

  • Code Review

    blueberrycongee/termcanvas

    Structured code review skill. An agent skill from blueberrycongee/termcanvas.

    406 GitHub stars~804 tokensUpdated 4 mo ago
    Auto-check passed

  • Hydra

    blueberrycongee/termcanvas

    A skill your agent uses when a task should run through Hydra's Lead-driven workflow for multi-agent orchestration, or when an existing workflow must be inspected or cleaned up.

    406 GitHub stars~2.2k tokensUpdated 4 mo ago
    Auto-check passed

  • QA

    blueberrycongee/termcanvas

    QA testing skill with real browser automation. An agent skill from blueberrycongee/termcanvas.

    406 GitHub stars~830 tokensUpdated 4 mo ago
    Auto-check passed

  • Investigate

    blueberrycongee/termcanvas

    Systematic debugging skill. An agent skill from blueberrycongee/termcanvas.

    406 GitHub stars~562 tokensUpdated 4 mo ago
    Auto-check passed

  • Using Termcanvas

    blueberrycongee/termcanvas

    A skill your agent uses when starting work in a TermCanvas-managed repo to route between direct work, Hydra, or a narrow TermCanvas skill.

    406 GitHub stars~793 tokensUpdated 4 mo ago
    Auto-check passed

Works with

Categories

Questions about Security Audit

What does Security Audit do?

Security audit skill. An agent skill from blueberrycongee/termcanvas. Security Audit is an agent skill from blueberrycongee/termcanvas. Security audit skill.

When should I use Security Audit?

Security Audit fits situations like: asked to audit security; check for vulnerabilities; security review; evaluating code that handles auth.

How do I install Security Audit in Claude Code?

Run `npx skills add blueberrycongee/termcanvas --skill security-audit -a claude-code`. Or copy the skill folder (skills/skills/security-audit in blueberrycongee/termcanvas) into .claude/skills/security-audit in your project. Claude Code loads it when a task matches its description.

How do I install Security Audit in Codex?

Run `npx skills add blueberrycongee/termcanvas --skill security-audit -a codex`. Or copy the skill folder (skills/skills/security-audit in blueberrycongee/termcanvas) into .agents/skills/security-audit in your project. Codex loads it when a task matches its description.

Can I use Security Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add blueberrycongee/termcanvas --skill security-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-audit, .gemini/skills/security-audit, .github/skills/security-audit and .opencode/skills/security-audit in your project.

What does Security Audit need to run?

Going by SKILL.md and its folder, Security Audit needs the command-line tools its instructions call (git, npm and pip).

Does Security Audit access the network?

SKILL.md contains no URLs. Its commands use git, npm and pip, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Security Audit safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Security Audit use?

Security Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security Audit use?

About 966 tokens (SKILL.md is roughly 3.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security Audit?

Skills that share tags, products or a category with Security Audit: Commit Security Scan (codexstar69/bug-hunter, 519 stars), Security (notque/vexjoy-agent, 438 stars), Repo Sentinel (Mathews-Tom/armory, 328 stars) and Security Ownership Map (diegosouzapw/awesome-omni-skills, 159 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security Audit?

blueberrycongee (a GitHub user) maintains it in blueberrycongee/termcanvas, which has 406 GitHub stars. The repository holds 7 skills in this directory. The repository was last updated on May 31, 2026.

Source: blueberrycongee/termcanvas on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.