R
risewithvj/AI-Security-Audit-Skills
Proof-backed AI security audit and VAPT skills for Claude Code
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
Client config (built from the install command this repo gives)
{
"mcpServers": {
"risewithvj-ai-security-audit-skills": {
"command": "npx",
"args": ["skills"]
}
}
}Parsed from the README we fetched on 2026-11-10; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"risewithvj-ai-security-audit-skills": {
"command": "npx",
"args": ["skills"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio risewithvj-ai-security-audit-skills -- npx skills
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Star count
- 1 ★ · risewithvj/AI-Security-Audit-Skills · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- read directly from its GitHub page · type: open-source project
- Harvest history
- first seen 2026-11-11 · last seen 2026-11-14 · seen 4× · listed by 2 sources
- Score
- score 203 · 1 ★ · 2 sources · repo
- Install
npx skills
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
npx skills. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: Agent 技能. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
risewithvj/AI-Security-Audit-Skills；first catalogued 2026-11-11；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.## 🛡️ Why this exists
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Vibe coding ships apps in days. Security reviews still take weeks, or never happen. So people install five, ten, fifteen security repos, run them all, and get back a wall of scanner noise and AI guesses that nobody trusts.
AI-Security-Audit-Skills takes the best methods from the most-starred security skills and scanners, removes the noise, and adds one thing none of them enforce together: proof.
> 💡 A finding that cannot point to the exact line of code, the attacker, and the concrete damage does not go in the report. Ever.
Two skills, one kit:
| | Skill | What it does |
| 🔍 | /ai-security-audit | Full source-code security audit (white-box VAPT) of any stack: web, API, vibe-coded apps, mobile, cloud/IaC, AI/LLM and MCP apps |
| 🇮🇳 | /ai-dpdp-audit | Dedicated India DPDP Act 2023 + DPDP Rules 2025 audit: PII data map, consent, Rule 6 safeguards, Rule 7 breach readiness, Rule 8 erasure, rights, children's data |
Both produce a VAPT-style DOCX and PDF report and never modify your code.
## 📄 What you get
Sample security audit report (PDF) · Sample DPDP audit report (PDF) · DOCX versions
Every confirmed finding includes: location, a plain-English summary, description, business impact, root cause, the source trace with file and line, the smallest safe fix with code, what the fix could break in production, a regression test, CWE, OWASP 2025 / API 2023 / LLM 2025 mapping, CVSS 4.0, confidence and verifier votes.
## ⚡ What makes it different
| Typical AI security review | AI-Security-Audit-Skills |
| Scanner hits pasted as "vulnerabilities" | Scanner hits are leads; each is traced or dismissed with a reason |
| The AI that found a bug also confirms it | Independent verifiers try to refute it (3 votes in standard mode) and never see the finder's reasoning |
| Cited code is sometimes invented | aisa.py validate re-reads every cited file and line and fails the run if the snippet is not there |
| "Might be vulnerable", "consider adding..." | Hedge words are rejected in confirmed findings. Unsure means needs verification, with the one fact that settles it |
| Severity by gut feeling | CVSS 4.0 vector checked for syntax and score; severity may sit at most one band above it, and only with a written reason |
| Reads the whole repo, burns tokens | Disciplined mapping: map once, load only the checklists your stack uses, tools before tokens |
| Says "the app is secure" | Says exactly what was checked and what was not |
| Auto-fixes that can break production | Recommendations only, each with its production risk and a regression test |
| Secrets copied into reports | Secrets masked everywhere; the validator blocks unredacted keys |
## 🧭 How it works
mermaid
flowchart LR
A[0. Scope gate read-only, source-only] --> B[1. Recon map, trust boundaries, coverage ledger]
B --> C[2. Scanners Semgrep, Gitleaks, Trivy, OSV]
C --> D[3. Hunt isolated hunters per attack class + critics]
D --> E[4. Verify 3 independent votes, machine validation]
E --> F[5. Report DOCX + PDF, recommendations]
style A fill:#1A1A1A,color:#fff,stroke:#FF2A1F
style E fill:#FF2A1F,color:#fff,stroke:#0A0A0A
style F fill:#0A0A0A,color:#fff,stroke:#FF2A1F
The evidence gate: six boxes every confirmed finding must fill
AI-Security-Audit-Skills takes the best methods from the most-starred security skills and scanners, removes the noise, and adds one thing none of them enforce together: proof.
> 💡 A finding that cannot point to the exact line of code, the attacker, and the concrete damage does not go in the report. Ever.
Two skills, one kit:
| | Skill | What it does |
| 🔍 | /ai-security-audit | Full source-code security audit (white-box VAPT) of any stack: web, API, vibe-coded apps, mobile, cloud/IaC, AI/LLM and MCP apps |
| 🇮🇳 | /ai-dpdp-audit | Dedicated India DPDP Act 2023 + DPDP Rules 2025 audit: PII data map, consent, Rule 6 safeguards, Rule 7 breach readiness, Rule 8 erasure, rights, children's data |
Both produce a VAPT-style DOCX and PDF report and never modify your code.
## 📄 What you get
Sample security audit report (PDF) · Sample DPDP audit report (PDF) · DOCX versions
Every confirmed finding includes: location, a plain-English summary, description, business impact, root cause, the source trace with file and line, the smallest safe fix with code, what the fix could break in production, a regression test, CWE, OWASP 2025 / API 2023 / LLM 2025 mapping, CVSS 4.0, confidence and verifier votes.
## ⚡ What makes it different
| Typical AI security review | AI-Security-Audit-Skills |
| Scanner hits pasted as "vulnerabilities" | Scanner hits are leads; each is traced or dismissed with a reason |
| The AI that found a bug also confirms it | Independent verifiers try to refute it (3 votes in standard mode) and never see the finder's reasoning |
| Cited code is sometimes invented | aisa.py validate re-reads every cited file and line and fails the run if the snippet is not there |
| "Might be vulnerable", "consider adding..." | Hedge words are rejected in confirmed findings. Unsure means needs verification, with the one fact that settles it |
| Severity by gut feeling | CVSS 4.0 vector checked for syntax and score; severity may sit at most one band above it, and only with a written reason |
| Reads the whole repo, burns tokens | Disciplined mapping: map once, load only the checklists your stack uses, tools before tokens |
| Says "the app is secure" | Says exactly what was checked and what was not |
| Auto-fixes that can break production | Recommendations only, each with its production risk and a regression test |
| Secrets copied into reports | Secrets masked everywhere; the validator blocks unredacted keys |
## 🧭 How it works
mermaid
flowchart LR
A[0. Scope gate read-only, source-only] --> B[1. Recon map, trust boundaries, coverage ledger]
B --> C[2. Scanners Semgrep, Gitleaks, Trivy, OSV]
C --> D[3. Hunt isolated hunters per attack class + critics]
D --> E[4. Verify 3 independent votes, machine validation]
E --> F[5. Report DOCX + PDF, recommendations]
style A fill:#1A1A1A,color:#fff,stroke:#FF2A1F
style E fill:#FF2A1F,color:#fff,stroke:#0A0A0A
style F fill:#0A0A0A,color:#fff,stroke:#FF2A1F
The evidence gate: six boxes every confirmed finding must fill
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/risewithvj-ai-security-audit-skills/)
- Source
- github · https://github.com/risewithvj/AI-Security-Audit-Skills
- Browse by field
- Agent skills
- Traction
- 1 ★
- Listed by
- 2 independent sources
- added
- today
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.