Skill
Repo Security Auditor
Audit GitHub repositories for security vulnerabilities, malicious code patterns, and suspicious behavior. Clone repos, analyze code for backdoors, data exfil...
When to use Repo Security Auditor
Choose if
You want an agent-driven first-pass security review of a GitHub repo before adoption — covering malicious patterns (network exfil, dynamic execution, obfuscation, crypto refs), dependency vulnerabilities, license compatibility, and a 0-10 verdict. Useful for triaging third-party libraries or scaffolding a clean reimplementation of a low-risk repo.
Avoid if
You need a defense-in-depth security certification or compliance-grade audit — this is a heuristic agent skill, not an accredited SAST/SCA pipeline. Also avoid when the workload is enterprise monorepo scale; the README describes single-repo clone-and-scan flows.
Risk Flags
- MEDIUM scope README does not disclose the precise pattern catalog or false-positive rates; risk scores are heuristic (0-10 weighted across six categories), not authoritative. Agents should treat the verdict as triage, not a security certification.
- LOW runtime README references `npm audit` and `safety` for dependency scanning but does not state which runtimes (Node, Python) must be present for those subscanners to work. Sandboxed environments without them may produce partial reports.
Cost
Type: Free
Distribution
- ClawHub
repo-security-auditor- License
- MIT-0