b-open-io/code-audit-scripts
skills/code-audit-scripts/SKILL.md
Run deterministic code security and quality scans — secret detection, debug artifact cleanup, and TODO/FIXME tracking. Use this skill before any security review, code audit, PR review, or when the user says 'scan for secrets', 'find debug logs', 'check for TODOs', 'audit this code', 'security scan', or 'clean up before shipping'. Also use proactively before deployments or when reviewing unfamiliar codebases. Runs all scans in parallel for speed.
$ install --global
skillsauthnpx skillsauth add b-open-io/prompts code-audit-scriptsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 29, 2026, 3:51 AM37.3s8 files scanned
SKILL.md
- name:
- code-audit-scripts
- description:
- Run deterministic code security and quality scans — secret detection, debug artifact cleanup, and TODO/FIXME tracking. Use this skill before any security review, code audit, PR review, or when the user says 'scan for secrets', 'find debug logs', 'check for TODOs', 'audit this code', 'security scan', or 'clean up before shipping'. Also use proactively before deployments or when reviewing unfamiliar codebases. Runs all scans in parallel for speed.
- user-invocable:
- true
Code Audit Scripts
Deterministic security and quality scans that output structured JSON. No LLM reasoning needed for the scanning — your job is to interpret results and recommend fixes.
Quick Start
Run everything at once:
bash <skill-path>/scripts/parallel-audit.sh /path/to/project
Returns a merged JSON report with all findings categorized by type and severity.
Individual Scans
Scan for Hardcoded Secrets
bash <skill-path>/scripts/scan-secrets.sh /path/to/project
Detects: API_KEY, SECRET, PASSWORD, PRIVATE_KEY, ACCESS_KEY, DATABASE_URL, JWT_SECRET, STRIPE_SK, and more. Filters out references to env vars (process.env, os.environ) to reduce false positives.
Scan for Debug Artifacts
bash <skill-path>/scripts/scan-debug.sh /path/to/project
# Include test files:
bash <skill-path>/scripts/scan-debug.sh /path/to/project --include-tests
Detects: console.log/debug/warn, debugger statements (JS/TS), print/breakpoint (Python), fmt.Println (Go). Skips test files by default.
Scan for TODOs and FIXMEs
bash <skill-path>/scripts/scan-todos.sh /path/to/project
Categorizes by severity:
- High: FIXME, BUG, HACK, XXX — these need attention before shipping
- Low: TODO — tracked work items
Acting on Results
| Finding Type | What to Do | |---|---| | Secrets with real values | Immediately flag to user. Rotate the credential. Move to env var. | | Secrets that are env var refs | False positive — ignore | | Debug artifacts in src/ | Remove before shipping. List specific files and lines. | | Debug artifacts in tests | Usually fine. Only flag if excessive. | | FIXME/HACK/XXX | Flag as blockers for the current PR/deployment | | TODO | Informational. Mention count but don't block on them. |
The parallel-audit.sh output includes a summary object with counts per category and high_priority count — use this for quick pass/fail decisions.
Related Skills
b-open-io/claudex
tools
VerifiedTrustedCommunity
This skill should be used when a Claude Code session needs to keep working after Anthropic usage runs out, or when the user asks to run the Claude Code harness on GPT-5.6 Sol. Trigger phrases include "my Anthropic usage ran out", "I'm out of Claude usage", "usage limit reached, what now", "keep working on another model", "run Claude Code on GPT-5.6 Sol", "use GPT-5.6 Sol as the model", "set up claudex", "claudex isn't working", "route the harness through CLIProxyAPI", or "bill against my ChatGPT/Codex subscription". It stands up a local proxy so the Claude Code CLI runs on OpenAI's Codex backend as an escape hatch, and diagnoses that setup when it drifts. macOS + Homebrew.
14SKILL.mdUpdated Jul 17, 2026
b-open-io/visual-wayfinder
testing
VerifiedTrustedCommunity
This skill should be used when the user asks to "open Visual Wayfinder", "answer a Wayfinder ticket visually", "turn this decision into a configurator", "show Wayfinder choices as a dashboard", "prototype the Wayfinder questionnaire", or wants interactive choice cards, tradeoff controls, rankings, ranges, toggles, and consequence previews for one active Wayfinder decision. It wraps the Wayfinder skill and JSON Render; it never replaces the tracker or resolves more than the active decision.
14SKILL.mdUpdated Jul 16, 2026
b-open-io/visual-proposal
development
VerifiedTrustedCommunity
This skill should be used when the user asks to "make a visual proposal", "write this up so I can share it", "present these options visually", "diagram the trade-offs", "turn this plan into something reviewable", or requests a shareable design pitch, architecture proposal, RFC, options comparison, or visual roadmap for work that has not been built. It produces one self-contained, theme-aware HTML page led by grounded diagrams. Use visual-review instead for completed code changes; do not use this skill for internal task tracking.
14SKILL.mdUpdated Jul 16, 2026
b-open-io/plugin-settings
tools
VerifiedTrustedCommunity
This skill should be used when the user asks to "add plugin settings", "make a plugin configurable", "store per-project plugin configuration", "use settings.local.json", "create a plugin state file", "expose skill settings in Agent Master", or "add a skill interface". Distinguishes official Claude Code settings from project-owned configuration and documents bOpen Agent Master skill interface discovery.
14SKILL.mdUpdated Jul 16, 2026