About

Imported from ersinkoc/security-check (SKILL.md). Install upstream with npx skills add ersinkoc/security-check. Copyright stays with the author (MIT).

security-check

Name: security-check
Author: ersinkoc

Your AI Becomes a Security Team. Every Language. Every Layer. Zero Tools.

What This Skill Does

security-check transforms your AI coding assistant into a comprehensive security scanning team. It runs a 4-phase pipeline — Recon → Hunt → Verify → Report — entirely through natural language. No binaries, no dependencies, no CI pipeline changes.

Quick Start

After installation, open your AI assistant and say:

"run security check" — Full security audit
"scan diff" — PR/diff-level incremental scan
"scan for vulnerabilities" — Same as full scan

What's Included

48 Security Skills

Category	Count	Skills
Core Pipeline	6	Orchestrator, Recon, Dependency Audit, Verifier, Report, Diff Report
Injection	9	SQLi, NoSQLi, GraphQL, XSS, SSTI, XXE, LDAP, CMDi, Header Injection
Code Execution	2	RCE, Deserialization
Access Control	4	Auth, AuthZ, Privilege Escalation, Session
Data Exposure	3	Secrets, Data Exposure, Crypto
Server-Side	4	SSRF, Path Traversal, File Upload, Open Redirect
Client-Side	4	CSRF, CORS, Clickjacking, WebSocket
Logic & Design	3	Business Logic, Race Conditions, Mass Assignment
API Security	3	API Security, Rate Limiting, JWT
Infrastructure	3	IaC, Docker, CI/CD
Language Scanners	7	Go, TypeScript, Python, PHP, Rust, Java, C#

10 Security Checklists (3000+ items)

Each language scanner includes a 400+ item checklist with specific CWE references.

4-Phase Pipeline

Phase 1: RECON        → Architecture mapping, tech stack detection
Phase 2: HUNT         → 40+ vulnerability skills run in parallel
Phase 3: VERIFY       → False positive elimination, confidence scoring
Phase 4: REPORT       → CVSS severity, remediation roadmap

Output

After scanning, a security-report/ directory is created containing:

SECURITY-REPORT.md — Final consolidated report
architecture.md — Codebase architecture map
dependency-audit.md — Supply chain analysis
verified-findings.md — Findings after false positive elimination

More Information

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/ersinkoc-security-check-security-check/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

ersinkoc-security-check-security-check.ocm.jsonjson

{
  "ocm": "1",
  "id": "ersinkoc-security-check-security-check",
  "kind": "skill",
  "name": "security-check",
  "description": "Comprehensive AI-powered security scanning suite with 48 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when you need to run a security audit, find vulnerabilities, scan a PR for security issues, or perform a penetration test on a codebase.",
  "publisher": "ersinkoc",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding",
      "math"
    ],
    "tags": [
      "skill-md",
      "security",
      "vulnerability-scanning",
      "owasp",
      "sast",
      "code-review",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Comprehensive AI-powered security scanning suite with 48 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when you need to run a security audit, find vulnerabilities, scan a PR for security issues, or perform a penetration test on a codebase."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/ersinkoc/security-check",
      "path": "SKILL.md",
      "ref": "d19bcf68dfb8a5397773073d7b7245226b2b8894",
      "url": "https://github.com/ersinkoc/security-check/blob/d19bcf68dfb8a5397773073d7b7245226b2b8894/SKILL.md",
      "key": "ersinkoc/security-check/SKILL.md"
    },
    "compatibility": "Works with Claude Code, Cursor, Codex, Gemini CLI, OpenCode, Windsurf, Roo Code, Amp, and all agentskills.io compatible agents",
    "license": "MIT"
  },
  "instructions": "# security-check\n\n> Your AI Becomes a Security Team. Every Language. Every Layer. Zero Tools.\n\n## What This Skill Does\n\nsecurity-check transforms your AI coding assistant into a comprehensive security scanning team.\nIt runs a 4-phase pipeline — **Recon → Hunt → Verify → Report** — entirely through natural language.\nNo binaries, no dependencies, no CI pipeline changes.\n\n## Quick Start\n\nAfter installation, open your AI assistant and say:\n\n- **\"run security check\"** — Full security audit\n- **\"scan diff\"** — PR/diff-level incremental scan\n- **\"scan for vulnerabilities\"** — Same as full scan\n\n## Wh",
  "cost": {
    "context_tokens": 584
  }
}

Fetch it by URL: GET /api/v1/registry/ersinkoc-security-check-security-check/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.