SkillsAdd

smithery.ai

ralph-security-audit

Run comprehensive security audit combining multiple scanners (npm audit, pip-audit, semgrep, trivy) with secret detection, dependency vulnerability scanning, and OWASP Top 10 checks. Use for security review before deployment or during PR review.

First seen Apr 14, 2026

Installation

$ npx skills add https://smithery.ai
View on skills.sh ↗ Website ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

firebase-security-rules-auditor Similar name
firebase/agent-skills

>- Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege esc…

111K installs
better-auth-security-best-practices Similar name
better-auth/skills

Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, s…

30.3K installs
firestore-security-rules-auditor Similar name
firebase/agent-skills 20.4K installs
security-review Similar name
getsentry/skills

Security code review for vulnerabilities.

15.5K installs
security-best-practices Similar name
openai/skills

Perform language and framework specific security best-practice reviews and suggest improvements…

8.2K installs
security-threat-model Similar name
openai/skills

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabili…

5.4K installs

Also in this package

Other skills from smithery.ai · top by installs.

npx skills add https://smithery.ai
smithery-ai-cli 7.8K frontend-design 6.2K skill-creator 2.5K ck:ui-ux-pro-max 1.3K pdf 1.2K xlsx 966 pptx 894 docx 884 webapp-testing 1 web-design-reviewer 657

Browse all from smithery.ai

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Skill metadata

Parsed from SKILL.md frontmatter.

Allowed toolsRead, Bash, Grep, Glob

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 1,677 B
  • docs SUMMARY.md 273 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 1 installs

SKILL.md

Ralph Ultra Security Audit

Comprehensive multi-scanner security analysis.

What this does

  1. Dependency scanning — npm audit, pip-audit, cargo-audit
  2. Static analysis — semgrep with auto-config rules
  3. Container scanning — trivy for Docker images
  4. Secret detection — Regex-based scan for API keys, tokens, passwords
  5. OWASP Top 10 — Check for common vulnerability patterns
  6. License audit — Flag copyleft licenses in commercial projects

Usage

/ralph-ultra:ralph-security-audit [--fix] [--severity critical,high]

Options

Option Description
--fix Auto-fix safe vulnerabilities (patch updates)
--severity Only report issues at specified levels

Severity Levels

  • CRITICAL — Immediate action required (RCE, auth bypass)
  • HIGH — Fix before deployment (SQL injection, XSS)
  • MEDIUM — Fix in next sprint (info disclosure, CSRF)
  • LOW — Track for later (deprecated APIs, minor config issues)

Scanners Used

Runs whichever tools are available:

  • npm audit / yarn audit — Node.js dependencies
  • pip-audit / safety — Python dependencies
  • semgrep — Multi-language SAST
  • trivy — Container and filesystem scanning
  • Built-in regex — Hardcoded secrets, insecure URLs, .env exposure