{"id":"947a532d-b3f4-48ec-a1f9-3b0201b23a9d","shortId":"5PTrGv","kind":"skill","title":"verify-security","tagline":"Verify code for security issues including hardcoded secrets, input validation, error exposure, and dependency vulnerabilities. Use when asked to \"verify security\", \"check for secrets\", or \"scan for vulnerabilities\".","description":"# Security Verification\n\n## Purpose\n\nVerify code for security anti-patterns and vulnerabilities. All analysis happens locally—code never leaves your machine.\n\n## When to Use\n\nTrigger this skill when the user asks to:\n- \"verify agent security\"\n- \"verify security\"\n- \"check for secrets\"\n- \"scan for vulnerabilities\"\n- \"security audit\"\n\n> **Note:** For full verification including patterns, quality, and language-specific checks, tell the user to say **\"verify agent\"**.\n\n## Process\n\n### Step 1: Discover Files\n\nLocate files to analyze:\n\n**Configuration files:**\n- `package.json`, `pyproject.toml`, `Cargo.toml` - Dependencies\n- `.env`, `.env.example`, `.env.local` - Environment files\n- `config.py`, `settings.py`, `config.ts` - Configuration\n\n**Source files:**\n- `*.py`, `*.ts`, `*.js`, `*.go`, `*.rs` - Source code\n- Prioritize files with: `auth`, `api`, `client`, `secret`, `config` in name\n\n**Exclude:**\n- `node_modules/`, `.venv/`, `venv/`, `__pycache__/`\n- `*.test.*`, `*.spec.*`, `*_test.go`\n\n### Step 2: Run Security Checks\n\n#### Check Tiers\n\n- **`[PATTERN]`** — Mechanical check. Apply exactly as written.\n- **`[HEURISTIC]`** — Judgment required. Mark findings clearly.\n\nTag every finding with `[P]` for pattern or `[H]` for heuristic.\n\n---\n\n#### 2.1 `[PATTERN]` Hardcoded Secrets\n\nScan for assignments matching these patterns (case-insensitive):\n\n| Variable pattern | Fail condition |\n|------------------|----------------|\n| `API_KEY` | Assigned to string literal |\n| `SECRET` | Assigned to string literal |\n| `PASSWORD` | Assigned to string literal |\n| `TOKEN` | Assigned to string literal |\n| `PRIVATE_KEY` | Assigned to string literal |\n| `AWS_ACCESS_KEY_ID` | Assigned to string literal |\n| `AWS_SECRET_ACCESS_KEY` | Assigned to string literal |\n\n**Examples of failures:**\n\n```python\n# ❌ Issue\nAPI_KEY = \"sk-abc123...\"\npassword = \"hunter2\"\nOPENAI_API_KEY = \"sk-proj-...\"\n\n# ✅ Pass\nAPI_KEY = os.environ[\"API_KEY\"]\npassword = os.getenv(\"PASSWORD\")\napi_key = settings.API_KEY\n```\n\n**Also flag:**\n- String literals matching known API key patterns:\n  - `sk-...` (OpenAI)\n  - `sk-ant-...` (Anthropic)\n  - `AKIA...` (AWS)\n  - `ghp_...` (GitHub)\n  - `xoxb-...` (Slack)\n\nSeverity: ❌ Issue\n\n---\n\n#### 2.2 `[PATTERN]` Dependency Version Pinning\n\n**Python (`requirements.txt`):**\n\n| Pattern | Severity |\n|---------|----------|\n| `package>=1.0` | ❌ Issue |\n| `package>1.0` | ❌ Issue |\n| `package` (no version) | ❌ Issue |\n| `package==1.0.0` | ✅ Pass |\n| `package~=1.0` | ✅ Pass |\n\n**Python (`pyproject.toml`):**\n\nCheck `[project.dependencies]` and `[tool.poetry.dependencies]`:\n- Unpinned or `>=` versions → ❌ Issue\n- Pinned with `==` or `^` or `~` → ✅ Pass\n\n**JavaScript/TypeScript (`package.json`):**\n\n| Pattern | Severity |\n|---------|----------|\n| `\"package\": \"*\"` | ❌ Issue |\n| `\"package\": \"latest\"` | ❌ Issue |\n| `\"package\": \">=1.0.0\"` | ⚠️ Warning |\n| `\"package\": \"^1.0.0\"` | ✅ Pass |\n| `\"package\": \"~1.0.0\"` | ✅ Pass |\n| `\"package\": \"1.0.0\"` | ✅ Pass |\n\n---\n\n#### 2.3 `[HEURISTIC]` Input Validation\n\nCheck for external data handling:\n\n**Look for:**\n- HTTP request handlers (`@app.route`, `router.get`, etc.)\n- User input processing (`request.body`, `req.params`, `input()`)\n- File uploads\n- Database queries with user input\n\n**Flag if:**\n- User input is passed directly to database queries without sanitization\n- File paths are constructed from user input without validation\n- JSON parsing without schema validation on external data\n\nSeverity: ⚠️ Warning\n\n**Example patterns to flag:**\n\n```python\n# ⚠️ Warning - SQL without parameterization\nquery = f\"SELECT * FROM users WHERE id = {user_id}\"\n\n# ⚠️ Warning - Path traversal risk\nfile_path = os.path.join(base_dir, user_filename)\n\n# ✅ Pass - Parameterized query\ncursor.execute(\"SELECT * FROM users WHERE id = ?\", (user_id,))\n```\n\n---\n\n#### 2.4 `[HEURISTIC]` Error Message Exposure\n\nCheck error handling for information leakage:\n\n**Flag if:**\n- Stack traces returned in HTTP responses\n- Database error messages exposed to users\n- Internal paths or system info in error messages\n- Debug mode enabled in production code\n\n**Look for:**\n\n```python\n# ⚠️ Warning\nexcept Exception as e:\n    return {\"error\": str(e)}  # Exposes internal details\n\n# ⚠️ Warning\napp = Flask(__name__)\napp.debug = True  # Debug in production\n\n# ✅ Pass\nexcept Exception as e:\n    logger.error(f\"Error: {e}\")\n    return {\"error\": \"An error occurred\"}\n```\n\nSeverity: ⚠️ Warning\n\n---\n\n#### 2.5 `[HEURISTIC]` Secure Defaults\n\nCheck configuration for insecure defaults:\n\n| Setting | Insecure | Secure |\n|---------|----------|--------|\n| CORS | `*` (allow all) | Specific origins |\n| SSL verification | `verify=False` | `verify=True` or omitted |\n| Debug mode | `debug=True` | `debug=False` |\n| Cookie security | `secure=False` | `secure=True` |\n| CSRF | Disabled | Enabled |\n\n**Examples:**\n\n```python\n# ⚠️ Warning\nrequests.get(url, verify=False)\napp.config[\"SESSION_COOKIE_SECURE\"] = False\nCORS(app, origins=\"*\")\n\n# ✅ Pass\nrequests.get(url)  # verify=True is default\napp.config[\"SESSION_COOKIE_SECURE\"] = True\nCORS(app, origins=[\"https://example.com\"])\n```\n\nSeverity: ⚠️ Warning\n\n---\n\n#### 2.6 `[HEURISTIC]` Sensitive Data Logging\n\nCheck logging statements for sensitive data:\n\n**Flag if logging includes:**\n- Passwords or tokens\n- API keys\n- Personal identifiable information (PII)\n- Credit card numbers\n- Session tokens\n\n**Look for:**\n\n```python\n# ⚠️ Warning\nlogger.info(f\"User login: {username} with password {password}\")\nprint(f\"API response: {response.json()}\")  # May contain tokens\n\n# ✅ Pass\nlogger.info(f\"User login: {username}\")\nlogger.debug(f\"Request to {url}\")  # No sensitive data\n```\n\nSeverity: ⚠️ Warning\n\n---\n\n### Step 3: Generate Report\n\n```markdown\n# Security Verification Report\n\n**Project:** [name or path]\n**Date:** [current date]\n**Files analyzed:** [count]\n\n## Summary\n\n✅ X checks passed | ⚠️ Y warnings | ❌ Z issues\n\n## Secrets\n\n- [x] No hardcoded secrets found\n- [ ] ❌ Hardcoded secret at `[file:line]`\n\n## Dependencies\n\n- [x] All dependencies pinned\n- [ ] ❌ Unpinned dependencies in `[file]`\n\n## Input Validation\n\n- [x] External input properly validated\n- [ ] ⚠️ Potential injection at `[file:line]`\n\n## Error Handling\n\n- [x] Errors properly sanitized\n- [ ] ⚠️ Information leakage at `[file:line]`\n\n## Findings\n\n> `[P]` = pattern-matched · `[H]` = heuristic\n\n### ✅ Passing\n- `[P]` No hardcoded API keys or secrets\n- `[P]` Dependencies properly pinned\n\n### ⚠️ Warnings\n- `[H]` [Check]: [description]\n  - **Location:** [file:line]\n  - **Risk:** [what could go wrong]\n  - **Suggestion:** [how to fix]\n\n### ❌ Issues\n- `[P]` [Check]: [description]\n  - **Location:** [file:line]\n  - **Rule:** [which rule violated]\n  - **Fix:** [specific remediation]\n\n## Recommendations\n\n1. [Priority recommendation]\n2. [Additional improvements]\n```\n\n---\n\n*For full verification including patterns, quality, and language-specific checks, say \"verify agent\".*","tags":["verify","security","agent","verifier","aurite-ai","agent-skills","agent-testing","agent-verification","ai-agent","ai-coding-assistant","claude-code","cline"],"capabilities":["skill","source-aurite-ai","skill-verify-security","topic-agent-skills","topic-agent-testing","topic-agent-verification","topic-ai-agent","topic-ai-coding-assistant","topic-claude-code","topic-cline","topic-code-quality","topic-code-review","topic-code-verification","topic-coding-agent","topic-cursor"],"categories":["agent-verifier"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/Aurite-ai/agent-verifier/verify-security","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add Aurite-ai/agent-verifier","source_repo":"https://github.com/Aurite-ai/agent-verifier","install_from":"skills.sh"}},"qualityScore":"0.469","qualityRationale":"deterministic score 0.47 from registry signals: · indexed on github topic:agent-skills · 38 github stars · SKILL.md body (6,881 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T18:58:30.343Z","embedding":null,"createdAt":"2026-04-29T01:03:27.325Z","updatedAt":"2026-05-18T18:58:30.343Z","lastSeenAt":"2026-05-18T18:58:30.343Z","tsv":"'1':98,791 '1.0':303,306,316 '1.0.0':313,343,346,349,352 '2':149,794 '2.1':179 '2.2':293 '2.3':354 '2.4':455 '2.5':534 '2.6':607 '3':673 'abc123':248 'access':224,233 'addit':795 'agent':65,95,810 'akia':285 'allow':547 'also':270 'analysi':45 'analyz':104,688 'ant':283 'anthrop':284 'anti':40 'anti-pattern':39 'api':133,196,244,252,258,261,266,276,625,650,752 'app':510,587,602 'app.config':581,596 'app.debug':513 'app.route':368 'appli':158 'ask':21,62 'assign':185,198,203,208,213,219,227,235 'audit':76 'auth':132 'aw':223,231,286 'base':440 'card':632 'cargo.toml':109 'case':190 'case-insensit':189 'check':25,69,88,152,153,157,320,358,460,538,612,692,762,778,807 'clear':167 'client':134 'code':5,36,48,128,493 'condit':195 'config':136 'config.py':116 'config.ts':118 'configur':105,119,539 'construct':399 'contain':654 'cooki':565,583,598 'cor':546,586,601 'could':769 'count':689 'credit':631 'csrf':571 'current':685 'cursor.execute':447 'data':361,412,610,617,669 'databas':379,392,474 'date':684,686 'debug':488,515,559,561,563 'default':537,542,595 'depend':17,110,295,709,712,715,757 'descript':763,779 'detail':508 'dir':441 'direct':390 'disabl':572 'discov':99 'e':501,505,522,526 'enabl':490,573 'env':111 'env.example':112 'env.local':113 'environ':114 'error':14,457,461,475,486,503,525,528,530,730,733 'etc':370 'everi':169 'exact':159 'exampl':239,415,574 'example.com':604 'except':498,499,519,520 'exclud':139 'expos':477,506 'exposur':15,459 'extern':360,411,721 'f':425,524,641,649,658,663 'fail':194 'failur':241 'fals':554,564,568,580,585 'file':100,102,106,115,121,130,377,396,437,687,707,717,728,739,765,781 'filenam':443 'find':166,170,741 'fix':775,787 'flag':271,384,418,466,618 'flask':511 'found':703 'full':79,798 'generat':674 'ghp':287 'github':288 'go':125,770 'h':176,746,761 'handl':362,462,731 'handler':367 'happen':46 'hardcod':10,181,701,704,751 'heurist':162,178,355,456,535,608,747 'http':365,472 'hunter2':250 'id':226,430,432,452,454 'identifi':628 'improv':796 'includ':9,81,621,800 'info':484 'inform':464,629,736 'inject':726 'input':12,356,372,376,383,387,402,718,722 'insecur':541,544 'insensit':191 'intern':480,507 'issu':8,243,292,304,307,311,327,338,341,697,776 'javascript/typescript':333 'js':124 'json':405 'judgment':163 'key':197,218,225,234,245,253,259,262,267,269,277,626,753 'known':275 'languag':86,805 'language-specif':85,804 'latest':340 'leakag':465,737 'leav':50 'line':708,729,740,766,782 'liter':201,206,211,216,222,230,238,273 'local':47 'locat':101,764,780 'log':611,613,620 'logger.debug':662 'logger.error':523 'logger.info':640,657 'login':643,660 'look':363,494,636 'machin':52 'mark':165 'markdown':676 'match':186,274,745 'may':653 'mechan':156 'messag':458,476,487 'mode':489,560 'modul':141 'name':138,512,681 'never':49 'node':140 'note':77 'number':633 'occur':531 'omit':558 'openai':251,280 'origin':550,588,603 'os.environ':260 'os.getenv':264 'os.path.join':439 'p':172,742,749,756,777 'packag':302,305,308,312,315,337,339,342,345,348,351 'package.json':107,334 'parameter':423,445 'pars':406 'pass':257,314,317,332,347,350,353,389,444,518,589,656,693,748 'password':207,249,263,265,622,646,647 'path':397,434,438,481,683 'pattern':41,82,155,174,180,188,193,278,294,300,335,416,744,801 'pattern-match':743 'person':627 'pii':630 'pin':297,328,713,759 'potenti':725 'print':648 'priorit':129 'prioriti':792 'privat':217 'process':96,373 'product':492,517 'proj':256 'project':680 'project.dependencies':321 'proper':723,734,758 'purpos':34 'py':122 'pycach':144 'pyproject.toml':108,319 'python':242,298,318,419,496,575,638 'qualiti':83,802 'queri':380,393,424,446 'recommend':790,793 'remedi':789 'report':675,679 'req.params':375 'request':366,664 'request.body':374 'requests.get':577,590 'requir':164 'requirements.txt':299 'respons':473,651 'response.json':652 'return':470,502,527 'risk':436,767 'router.get':369 'rs':126 'rule':783,785 'run':150 'sanit':395,735 'say':93,808 'scan':29,72,183 'schema':408 'secret':11,27,71,135,182,202,232,698,702,705,755 'secur':3,7,24,32,38,66,68,75,151,536,545,566,567,569,584,599,677 'select':426,448 'sensit':609,616,668 'session':582,597,634 'set':543 'settings.api':268 'settings.py':117 'sever':291,301,336,413,532,605,670 'sk':247,255,279,282 'sk-abc123':246 'sk-ant':281 'sk-proj':254 'skill':58 'skill-verify-security' 'slack':290 'sourc':120,127 'source-aurite-ai' 'spec':146 'specif':87,549,788,806 'sql':421 'ssl':551 'stack':468 'statement':614 'step':97,148,672 'str':504 'string':200,205,210,215,221,229,237,272 'suggest':772 'summari':690 'system':483 'tag':168 'tell':89 'test':145 'test.go':147 'tier':154 'token':212,624,635,655 'tool.poetry.dependencies':323 'topic-agent-skills' 'topic-agent-testing' 'topic-agent-verification' 'topic-ai-agent' 'topic-ai-coding-assistant' 'topic-claude-code' 'topic-cline' 'topic-code-quality' 'topic-code-review' 'topic-code-verification' 'topic-coding-agent' 'topic-cursor' 'trace':469 'travers':435 'trigger':56 'true':514,556,562,570,593,600 'ts':123 'unpin':324,714 'upload':378 'url':578,591,666 'use':19,55 'user':61,91,371,382,386,401,428,431,442,450,453,479,642,659 'usernam':644,661 'valid':13,357,404,409,719,724 'variabl':192 'venv':142,143 'verif':33,80,552,678,799 'verifi':2,4,23,35,64,67,94,553,555,579,592,809 'verify-secur':1 'version':296,310,326 'violat':786 'vulner':18,31,43,74 'warn':344,414,420,433,497,509,533,576,606,639,671,695,760 'without':394,403,407,422 'written':161 'wrong':771 'x':691,699,710,720,732 'xoxb':289 'y':694 'z':696","prices":[{"id":"feaf730b-74bb-4b2d-848b-33196d99a263","listingId":"947a532d-b3f4-48ec-a1f9-3b0201b23a9d","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"Aurite-ai","category":"agent-verifier","install_from":"skills.sh"},"createdAt":"2026-04-29T01:03:27.325Z"}],"sources":[{"listingId":"947a532d-b3f4-48ec-a1f9-3b0201b23a9d","source":"github","sourceId":"Aurite-ai/agent-verifier/verify-security","sourceUrl":"https://github.com/Aurite-ai/agent-verifier/tree/main/skills/verify-security","isPrimary":false,"firstSeenAt":"2026-04-29T01:03:27.325Z","lastSeenAt":"2026-05-18T18:58:30.343Z"}],"details":{"listingId":"947a532d-b3f4-48ec-a1f9-3b0201b23a9d","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"Aurite-ai","slug":"verify-security","github":{"repo":"Aurite-ai/agent-verifier","stars":38,"topics":["agent-skills","agent-testing","agent-verification","ai-agent","ai-coding-assistant","claude-code","cline","code-quality","code-review","code-verification","coding-agent","cursor","devtools","langgraph","security","skills","windsurf"],"license":"mit","html_url":"https://github.com/Aurite-ai/agent-verifier","pushed_at":"2026-05-01T10:31:12Z","description":"Agent Verifier is a coding agent skill that verifies code against organizational policies, code quality patterns, security requirements, and framework best practices — before code ships. Works with Claude Code, Cursor, Windsurf, and 30+ agents.","skill_md_sha":"aad20f9dacc999e47a43ff746bae9de8a132df73","skill_md_path":"skills/verify-security/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/Aurite-ai/agent-verifier/tree/main/skills/verify-security"},"layout":"multi","source":"github","category":"agent-verifier","frontmatter":{"name":"verify-security","description":"Verify code for security issues including hardcoded secrets, input validation, error exposure, and dependency vulnerabilities. Use when asked to \"verify security\", \"check for secrets\", or \"scan for vulnerabilities\"."},"skills_sh_url":"https://skills.sh/Aurite-ai/agent-verifier/verify-security"},"updatedAt":"2026-05-18T18:58:30.343Z"}}