Does it support dependency checking?

Yes, it utilizes 'uv run pip-audit' and 'safety check' to identify third-party components that have known security vulnerabilities.

When should I activate the security skill?

The skill auto-activates on keywords like 'audit', 'scan', or 'vulnerability', making it ideal for pre-commit checks and final pre-release security reviews.

What tools are used for vulnerability scanning?

The skill integrates industry-standard Python security tools including Bandit for static analysis, Semgrep for pattern matching, and pip-audit for dependency checks.

How does this skill help with OWASP compliance?

It provides specific checklists and scanning tools designed to mitigate the OWASP Top 10 vulnerabilities, such as injection, sensitive data exposure, and broken access control.

Can I use this for secret management?

Yes, it includes specialized workflows for encrypting secrets and validating GPG/SSH keys to prevent accidental leaks in your codebase.

Security & Compliance Validation

Name: Security & Compliance Validation
Author: ByronWilliamsCPA

byByronWilliamsCPA

보안 및 테스팅

Hardens software projects through automated security scanning, vulnerability detection, and comprehensive compliance auditing.

소개

This skill provides a robust security framework for Python-based applications and RAG pipelines by integrating industry-standard auditing tools directly into the development workflow. It automates critical tasks such as GPG/SSH key validation, dependency vulnerability scanning with Bandit and Safety, and secret management to ensure strict adherence to OWASP Top 10 guidelines and prevent sensitive data exposure.

주요 기능

Automated static analysis security testing (SAST) using Bandit and Semgrep
Secure environment validation for GPG, SSH, and Git signing
Structured security checklists for pre-commit and pre-release stages
Secret encryption and management workflows for sensitive pipeline data
Comprehensive dependency auditing for known CVEs and security flaws
0 GitHub stars

사용 사례

Automating security audits during the CI/CD release cycle
Hardening audio processing pipelines against injection and data exposure
Ensuring compliance with OWASP standards in Python-based RAG applications

소개

주요 기능

Automated static analysis security testing (SAST) using Bandit and Semgrep
Secure environment validation for GPG, SSH, and Git signing
Structured security checklists for pre-commit and pre-release stages
Secret encryption and management workflows for sensitive pipeline data
Comprehensive dependency auditing for known CVEs and security flaws
0 GitHub stars

사용 사례

Automating security audits during the CI/CD release cycle
Hardening audio processing pipelines against injection and data exposure
Ensuring compliance with OWASP standards in Python-based RAG applications