mxa-audit-security
Assesses a codebase and its running site for security by driving the standard scanners, and scores only what a scanner covered. It ships no scanner of its own.
- Runs five categories of check with industry-standard tools: vulnerable dependencies, leaked secrets in the tree and its history, static analysis, response headers and a passive scan of the running site
- Chooses the static-analysis rules from the languages in the tree, so a React app and a Rails app get different rules from the same skill
- Scores only the categories a scanner ran, and states the unseen share as the ceiling, so a high number can never mean nobody looked
- Writes two reports, one for the client and one to work through, and sends a leaked key to rotation rather than deletion
- Runs at the start of an engagement, before a promotion and on a live estate, and never becomes a gate
What is inside
The checks module drives gitleaks, OSV-Scanner, Semgrep and the site scanners and maps their reports onto the artifact. It scans nothing itself.
- Uses
- gitleaksOSV-ScannerTrivySemgrepBrakemanMozilla ObservatoryOWASP ZAP
- Evals
- 3
Works with
The outside tools and connectors this skill drives.
- gitleaks· our default
- OSV-Scanner or Trivy
- Semgrep, with Brakeman on Rails
- Mozilla Observatory
- OWASP ZAP baseline
The first is what we reach for on our own projects. A project that already uses one of the others keeps it, and the skill works with that instead.