Name: claude-skill-security-auditor
Author: wrsmith108

Imported from wrsmith108/claude-skill-security-auditor (SKILL.md). Install upstream with npx skills add wrsmith108/claude-skill-security-auditor. Copyright stays with the author.

Security Auditor Skill

Run structured security audits with actionable remediation plans.

Trigger Phrases

"npm audit"
"security vulnerability"
"dependency vulnerability"
"CVE"
"security check"
"audit dependencies"
"check vulnerabilities"

Description

This skill performs comprehensive security audits on npm projects, parsing vulnerability data and generating actionable remediation plans with prioritized fixes.

Capabilities

Execute npm audit --json and parse structured output
Classify vulnerabilities by severity (critical, high, medium, low)
Extract CVE identifiers, affected versions, and fix versions
Distinguish direct vs transitive dependencies
Generate markdown reports with remediation commands
Support risk acceptance via security-exceptions.json
Provide CI-friendly exit codes

Usage

Basic Audit

npx tsx scripts/index.ts

JSON Output

npx tsx scripts/index.ts --json

Fail on High+ Severity (for CI)

npx tsx scripts/index.ts --fail-on high

Fail on Critical Only

npx tsx scripts/index.ts --fail-on critical

Risk Acceptance

Create a security-exceptions.json file in your project root to accept known risks:

{
  "exceptions": [
    {
      "id": "GHSA-xxxx-xxxx-xxxx",
      "reason": "Not exploitable in our usage context",
      "expires": "2025-06-01",
      "approvedBy": "security-team"
    }
  ]
}

Exit Codes

0 - No vulnerabilities above threshold
1 - Vulnerabilities found above threshold (with --fail-on)
2 - Error running audit

Requirements

Node.js and npm installed
Valid package.json in target directory
Optional: package-lock.json for accurate audit

Install claude-skill-security-auditor and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "wrsmith108-claude-skill-security-auditor-claude-skill-se-b1d85e", "kind": "skill", "name": "claude-skill-security-auditor", "description": "Run structured security audits with actionable remediation plans.", "publisher": "wrsmith108", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Run structured security audits with actionable remediation plans." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/wrsmith108/claude-skill-security-auditor", "path": "SKILL.md", "ref": "b9c0dafb93a3e0e5cbaaa988473609e75c506fbf", "url": "https://github.com/wrsmith108/claude-skill-security-auditor/blob/b9c0dafb93a3e0e5cbaaa988473609e75c506fbf/SKILL.md", "key": "wrsmith108/claude-skill-security-auditor/SKILL.md" } }, "instructions": "# Security Auditor Skill\n\nRun structured security audits with actionable remediation plans.\n\n## Trigger Phrases\n- \"npm audit\"\n- \"security vulnerability\"\n- \"dependency vulnerability\"\n- \"CVE\"\n- \"security check\"\n- \"audit dependencies\"\n- \"check vulnerabilities\"\n\n## Description\nThis skill performs comprehensive security audits on npm projects, parsing vulnerability data and generating actionable remediation plans with prioritized fixes.\n\n## Capabilities\n- Execute `npm audit --json` and parse structured output\n- Classify vulnerabilities by severity (critical, high, medium, low)\n- Extract CVE identif", "cost": { "context_tokens": 433 } }

claude-skill-security-auditor

About