verify-security

# Security Verification ## Purpose Verify code for security anti-patterns and vulnerabilities. All analysis happens locally—code never leaves your machine. ## When to Use Trigger this skill when the user asks to: - "verify agent security" - "verify security" - "check for secrets" - "scan for vulnerabilities" - "security audit" > **Note:** For full verification including patterns, quality, and language-specific checks, tell the user to say **"verify agent"**. ## Process ### Step 1: Discover Files Locate files to analyze: **Configuration files:** - `package.json`, `pyproject.toml`, `Cargo.toml` - Dependencies - `.env`, `.env.example`, `.env.local` - Environment files - `config.py`, `settings.py`, `config.ts` - Configuration **Source files:** - `*.py`, `*.ts`, `*.js`, `*.go`, `*.rs` - Source code - Prioritize files with: `auth`, `api`, `client`, `secret`, `config` in name **Exclude:** - `node_modules/`, `.venv/`, `venv/`, `__pycache__/` - `*.test.*`, `*.spec.*`, `*_test.go` ### Step 2: Run Security Checks #### Check Tiers - **`[PATTERN]`** — Mechanical check. Apply exactly as written. - **`[HEURISTIC]`** — Judgment required. Mark findings clearly. Tag every finding with `[P]` for pattern or `[H]` for heuristic. --- #### 2.1 `[PATTERN]` Hardcoded Secrets Scan for assignments matching these patterns (case-insensitive): | Variable pattern | Fail condition | |------------------|----------------| | `API_KEY` | Assigned to string literal | | `SECRET` | Assigned to s...