risewithvj/AI-Security-Audit-Skills

Vibe coding ships apps in days. Security reviews still take weeks, or never happen. So people install five, ten, fifteen security repos, run them all, and get back a wall of scanner noise and AI guesses that nobody trusts.
AI-Security-Audit-Skills takes the best methods from the most-starred security skills and scanners, removes the noise, and adds one thing none of them enforce together: proof.
> 💡 A finding that cannot point to the exact line of code, the attacker, and the concrete damage does not go in the report. Ever.
Two skills, one kit:
| | Skill | What it does |
| 🔍 | /ai-security-audit | Full source-code security audit (white-box VAPT) of any stack: web, API, vibe-coded apps, mobile, cloud/IaC, AI/LLM and MCP apps |
| 🇮🇳 | /ai-dpdp-audit | Dedicated India DPDP Act 2023 + DPDP Rules 2025 audit: PII data map, consent, Rule 6 safeguards, Rule 7 breach readiness, Rule 8 erasure, rights, children's data |
Both produce a VAPT-style DOCX and PDF report and never modify your code.
## 📄 What you get
Sample security audit report (PDF) · Sample DPDP audit report (PDF) · DOCX versions
Every confirmed finding includes: location, a plain-English summary, description, business impact, root cause, the source trace with file and line, the smallest safe fix with code, what the fix could break in production, a regression test, CWE, OWASP 2025 / API 2023 / LLM 2025 mapping, CVSS 4.0, confidence and verifier votes.
## ⚡ What makes it different
| Typical AI security review | AI-Security-Audit-Skills |
| Scanner hits pasted as "vulnerabilities" | Scanner hits are leads; each is traced or dismissed with a reason |
| The AI that found a bug also confirms it | Independent verifiers try to refute it (3 votes in standard mode) and never see the finder's reasoning |
| Cited code is sometimes invented | aisa.py validate re-reads every cited file and line and fails the run if the snippet is not there |
| "Might be vulnerable", "consider adding..." | Hedge words are rejected in confirmed findings. Unsure means needs verification, with the one fact that settles it |
| Severity by gut feeling | CVSS 4.0 vector checked for syntax and score; severity may sit at most one band above it, and only with a written reason |
| Reads the whole repo, burns tokens | Disciplined mapping: map once, load only the checklists your stack uses, tools before tokens |
| Says "the app is secure" | Says exactly what was checked and what was not |
| Auto-fixes that can break production | Recommendations only, each with its production risk and a regression test |
| Secrets copied into reports | Secrets masked everywhere; the validator blocks unredacted keys |
## 🧭 How it works
mermaid
flowchart LR
A[0. Scope gate read-only, source-only] --> B[1. Recon map, trust boundaries, coverage ledger]
B --> C[2. Scanners Semgrep, Gitleaks, Trivy, OSV]
C --> D[3. Hunt isolated hunters per attack class + critics]
D --> E[4. Verify 3 independent votes, machine validation]
E --> F[5. Report DOCX + PDF, recommendations]
style A fill:#1A1A1A,color:#fff,stroke:#FF2A1F
style E fill:#FF2A1F,color:#fff,stroke:#0A0A0A
style F fill:#0A0A0A,color:#fff,stroke:#FF2A1F
The evidence gate: six boxes every confirmed finding must fill