opsmachine/1-security-audit
skills/1-security-audit/SKILL.md
Phase 1 of security audit pipeline. Scans the codebase for vulnerabilities and creates SECURITY_PLAN.md. Use after /full-security-audit or invoke directly to start a security review. Say 'security audit phase 1' or run '/1-security-audit'.
development
Updated Apr 22, 2026
$ install --global
skillsauthnpx skillsauth add opsmachine/om-agency 1-security-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 22, 2026, 3:51 PM211.2s1 file scanned
SKILL.md
- name:
- 1-security-audit
- description:
- Phase 1 of security audit pipeline. Scans the codebase for vulnerabilities and creates SECURITY_PLAN.md. Use after /full-security-audit or invoke directly to start a security review. Say 'security audit phase 1' or run '/1-security-audit'.
- tags:
- [security, audit, security-phase-1]
- state_source:
- security_plan
- params:
- []
- gates:
- []
- - field:
- findings
- sets_to:
- Pending
- side_effects:
- ["Creates SECURITY_PLAN.md"]
- next:
- [2-security-critique]
- human_gate:
- false
Phase 1: Security Discovery
What this phase does
Scan the codebase and produce a prioritized findings list. Output lives in SECURITY_PLAN.md.
Instructions
-
Scan
src/app(or configured API folder) for:- Mutable endpoints (POST/PUT/DELETE)
- Missing input validation (e.g. Zod schemas)
- Authorization gaps (missing auth checks, overly permissive RLS)
- Exposed secrets or service role keys in client code
- See
supabase-security/SKILL.mdfor Supabase-specific patterns to check
-
Output: Create or overwrite
SECURITY_PLAN.mdin the project root. List all findings asPendingwith severity (Critical / High / Medium / Low) and file location. -
Stop. Display a summary of findings to the user.
The next step is Phase 2: /2-security-critique
Related Skills
opsmachine/2-security-critique
testing
VerifiedTrustedCommunity
Phase 2 of security audit pipeline. Red team review of Phase 1 findings — removes false positives, adds missed risks, ranks the backlog. Invoke with '/2-security-critique' after Phase 1 is complete.
SKILL.mdUpdated Apr 23, 2026
openclaw/openclaw-secret-scanning-maintainer
development
VerifiedTrustedCommunity
Maintainer-only workflow for handling GitHub Secret Scanning alerts on OpenClaw. Use when Codex needs to triage, redact, clean up, and resolve secret leakage found in issue comments, issue bodies, PR comments, or other GitHub content.
357,764SKILL.mdUpdated Apr 15, 2026
openclaw/openclaw-release-maintainer
development
VerifiedTrustedCommunity
Maintainer workflow for OpenClaw releases, prereleases, changelog release notes, and publish validation. Use when Codex needs to prepare or verify stable or beta release steps, align version naming, assemble release notes, check release auth requirements, or validate publish-time commands and artifacts.
357,764SKILL.mdUpdated Apr 10, 2026
openclaw/openclaw-qa-testing
development
VerifiedTrustedCommunity
Run, watch, debug, and extend OpenClaw QA testing with qa-lab and qa-channel. Use when Codex needs to execute the repo-backed QA suite, inspect live QA artifacts, debug failing scenarios, add new QA scenarios, or explain the OpenClaw QA workflow. Prefer the live OpenAI lane with regular openai/gpt-5.4 in fast mode; do not use gpt-5.4-pro or gpt-5.4-mini unless the user explicitly overrides that policy.
357,764SKILL.mdUpdated Apr 10, 2026