security-snapshot

Solid

Use when the user says /security-snapshot, /snapshot <domain>, "run a security check on X", "generate a security report for [company]", or wants a security hygiene snapshot or free lead-magnet report on a prospect's public domain: SSL/TLS grade, HTTP security headers, SPF/DMARC email authentication, server fingerprint leaks. Passive, unauthenticated scans only. NOT for penetration testing, internal infrastructure audits, or application-layer vulnerability assessment.

Testing & QA 36 stars 35 forks Updated yesterday MIT

Install

View on GitHub

Quality Score: 81/100

Stars 20%
52
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

> **`{SKILL_DIR}`** = this skill's own folder (locally: the directory this SKILL.md lives in; a served brain substitutes the real absolute path before you read this). Shared starter files live at the repo root two levels up: `{SKILL_DIR}/../..`. If a path does not resolve, name the missing file and stop — never guess another location. When the user types /security-snapshot [domain] or asks for a security check on a prospect, run the security snapshot generator and deliver a client-ready report. ## Why this skill exists Prospects rarely have budget for a full security audit upfront, but they will read a free one-page report that exposes real issues with their public-facing setup. This skill generates that report in under 3 minutes and opens the door for a paid follow-up on security work, AI implementation, or adjacent consulting. ## Command ```bash python3 "{SKILL_DIR}/../../scripts/security-snapshot.py" <domain> --company "<Display Name>" ``` The script ships with the starter repo. Output goes to `$SNAPSHOTS_DIR` if set, otherwise `$VAULT_ROOT/security-snapshots/` if `VAULT_ROOT` is set, otherwise a `security-snapshots/` folder next to wherever you run the command from. It takes 60-180 seconds because SSL Labs is slow. The script prints the saved report path to stdout and progress to stderr. ## Workflow 1. **Get the domain.** If the user only gave a company name, ask for the domain (e.g., "Is it acme.com or acmecorp.com?"). Do not guess. 2. **Run the script.** Use Bas...

Details

Author
mycelium-hq
Repository
mycelium-hq/ai-brain-starter
Created
5 months ago
Last Updated
yesterday
Language
Python
License
MIT

Integrates with

Bundled in these plugins

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

security-check

Use this skill before installing ANY third-party skill, agent, or plugin — not for scanning your own project's source code (use /ievo:vuln-scan for that) and not for a structured pre-commit gap-detection review of a diff (use /ievo:deep-review for that). Vulnerability assessment by a senior application security engineer for a skill, agent, or plugin (Claude Code or Codex marketplace item) before installation. Domain expertise — prompt injection, credential exfiltration, supply-chain compromise, hook abuse, indirection attacks, encoded payloads, social engineering in technical artifacts, tool-model bypass. Deep content review across SKILL.md/agent.md body + ALL dependencies (scripts/, references/, assets/, bundled plugin files). Threat detection by expert reasoning, not regex. Returns structured verdict (GREEN/YELLOW/RED) with cited evidence (file + excerpt + concern). Invoked by the security-auditor agent in parallel per selected item.

0 Updated yesterday
ievo-ai
AI & Automation Listed

security-scan

Runs a repository or path security scan and produces a severity-ranked report covering hardcoded secrets and credential patterns, dependency CVEs via npm audit and equivalents, OWASP code patterns such as SQL injection, XSS, SSRF, path traversal and insecure deserialization, unsafe file permissions, and missing HTTP security headers. Use when a scan, audit, or vulnerability check is actually being asked for — /security-scan, scan for vulnerabilities, security audit, check for leaked secrets — or before shipping new code that adds authentication, cryptography, input handling, SQL, or file uploads. Reading, explaining, or editing code that merely happens to touch auth or SQL does not warrant it, since it emits a full scan report rather than an inline observation.

7 Updated 4 weeks ago
pfangueiro
AI & Automation Listed

security-tools

Quick local-environment verification for security analysis work. Runs the bundled `check.sh` script and reports whether the shell environment has the basics the security skills depend on. Invoke at the start of a security-focused session as a pre-flight.

1 Updated today
anttitevanlinna