hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- SPDX-License-Identifier: CC-BY-SA-4.0 --> <!-- SPDX-FileCopyrightText: Netresearch DTT GmbH -->
Security audit patterns (OWASP Top 10, CWE Top 25 2025, CVSS v4.0) and GitHub project security checks for any project. Deep automated PHP/TYPO3 code scanning with 80+ checkpoints, 41 reference guides, and PreToolUse warnings.
This is an Agent Skill following the open standard originally developed by Anthropic and released for cross-platform use.
Supported Platforms:
Skills are portable packages of procedural knowledge that work across any AI agent supporting the Agent Skills specification.
Add the Netresearch marketplace once, then browse and install skills:
# Claude Code
/plugin marketplace add netresearch/claude-code-marketplace
/plugin install security-audit@netresearch-claude-code-marketplaceSince Claude Code 2.1.157 a plugin directory under your personal skills directory loads on its own, including the hooks this repo ships:
mkdir -p ~/.claude/skills
git clone https://github.com/netresearch/security-audit-skill.git \
~/.claude/skills/security-auditIt loads as security-audit@skills-dir on the next session. Update with git -C ~/.claude/skills/security-audit pull and start a new session; remove it by deleting the directory. This route has no claude plugin update.
Install with any Agent Skills-compatible agent:
npx skills add https://github.com/netresearch/security-audit-skill --skill security-auditLimitation:npx skillsinstallsSKILL.md-based skills only. This repo also shipshooks, which it does not install — use the marketplace or the skills directory for those.
Download the latest release and extract to your agent's skills directory.
git clone https://github.com/netresearch/security-audit-skill.gitcomposer require netresearch/security-audit-skillRequires netresearch/composer-agent-skill-plugin.
npm install --save-dev \
@netresearch/agent-skill-coordinator \
github:netresearch/security-audit-skillRequires @netresearch/agent-skill-coordinator, which discovers the skill in node_modules and registers it in AGENTS.md via a postinstall hook. For pnpm, also allowlist the coordinator's postinstall:
{
"pnpm": {
"onlyBuiltDependencies": ["@netresearch/agent-skill-coordinator"]
}
}This skill is automatically triggered when:
Example queries:
security-audit-skill/
├── SECURITY.md # Security policy
├── hooks/
│ └── hooks.json # PreToolUse hook configuration
├── scripts/
│ ├── check_risky_command.py # Risky command detection hook
│ ├── validate_checkpoints.py # checkpoints.yaml structure check
│ └── test_*.py # Tests (run by ci.yml)
├── skills/security-audit/
│ ├── SKILL.md # Skill definition
│ ├── checkpoints.yaml # 80+ automated security checkpoints
│ ├── scripts/
│ │ ├── security-audit-dispatcher.sh # Detects the stack, runs the matching scanners
│ │ ├── scanners/ # Per-ecosystem scanner modules
│ │ ├── security-audit.sh # PHP project security audit
│ │ └── github-security-audit.sh # GitHub repo security audit
│ └── references/ # 41 reference guides
└── .github/
└── workflows/
├── ci.yml # Python tests
├── lint.yml # Skill validation, linters, ShellCheck
├── security.yml # Secret, workflow, dependency and SAST scans
└── release.yml # Release automationRun the tests from the repository root with uv:
uv run scripts/test_risky_patterns.py # hook patterns: expected matches and non-matches
uv run scripts/test_check_risky_command.py # hook input and output as Claude Code uses them
uv run scripts/test_audit_scripts.py # audit scripts against fixtures (needs bash 4+, GNU grep, jq)
uv run scripts/validate_checkpoints.py # checkpoints.yaml structure and unique IDs
pre-commit run --all-files # the linters CI runs in Skill ValidationCI runs the three test scripts on Python 3.12 and 3.13 (.github/workflows/ci.yml). A failing test prints its name and the assertion that failed; the test scripts exit non-zero. A change to the hook or the audit scripts comes with a test in these files.
grep -P) and find; github-security-audit.sh needs the gh CLI. The hook needs uv, which runs it on Python 3.11 or later, and uses only the standard library. composer, npm, govulncheck and trufflehog are optional: a scanner calls them only when command -v finds them, and the skill does not install them. TruffleHog runs with --no-verification; set SECURITY_AUDIT_VERIFY_SECRETS=1 to let it verify candidate secrets with their services.composer.json requires netresearch/composer-agent-skill-plugin (^2.0); package.json declares @netresearch/agent-skill-coordinator as a peer dependency. The repository commits no lock file for either; the consuming project resolves them.scripts/validate_checkpoints.py declares PyYAML as inline script metadata, which uv run installs; the test scripts use the standard library. The pre-commit hooks are pinned by rev: in .pre-commit-config.yaml. The workflows call reusable workflows from netresearch/skill-repo-skill, netresearch/.github and netresearch/typo3-ci-workflows at @main; the third-party actions inside those are pinned to commit SHAs there.renovate.json, config:recommended with pre-commit updates enabled) opens update pull requests, and .github/workflows/auto-merge-deps.yml hands them to the organisation's auto-merge workflow. On pull requests, dependency review and Composer Audit check the dependencies (.github/workflows/security.yml). New dependencies must meet the licence and vulnerability rules of the organisation's security policy linked below.This repository follows the Netresearch organisation policies:
The architecture of this skill (actors, components, data flows) is described in docs/ARCHITECTURE.md, and its security assurance case (threat model, trust boundaries, countermeasures and limits) in docs/SECURITY-ASSURANCE.md. Supported versions and vulnerability reporting: SECURITY.md.
Checks that run on every pull request to main in this repository:
.github/workflows/security.yml): Betterleaks secret scanning, zizmor workflow analysis, dependency review, and, through the typo3-ci-workflows security reusable, Composer Audit and Opengrep SAST (findings handled as the organisation's static analysis rule sets out)..github/workflows/lint.yml): skill structure, plugin manifest sync, markdownlint, yamllint, actionlint, JSON syntax, version checks, ShellCheck at the validator's default severity error, ruff and the checkpoint schema. The pre-commit hook runs ShellCheck at style..github/workflows/ci.yml): the tests listed under Development.codeql job of .github/workflows/security.yml.Which of these checks must pass before a merge is set in the repository's branch protection, not in this repository.
This project uses split licensing:
See the individual license files for full terms.
Developed and maintained by Netresearch DTT GmbH.
Made with love for Open Source by [Netresearch](https://www.netresearch.de/)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.