Security Audit Pipeline
Developer Official v1.0.26Scan code for vulnerabilities, categorize findings by OWASP type, prioritize by severity, and produce a remediation roadmap
by skrptiq
Sign in to import this skrpt into your workspace.
Sign inWhat's included 13 nodes
Security Audit Pipeline
Orchestrates a full security audit: scan for vulnerabilities, categorize by OWASP type, assess severity, plan remediation, and produce an executive report
Executive Reporting
Produces an executive summary and detailed technical findings report for separate audiences
Finding Categorization
Groups scan findings by OWASP Top 10 category for structured analysis and reporting
Remediation Planning
Generates specific fix recommendations per finding with code examples, effort estimates, and dependency mapping
Severity Assessment
Rates each finding by severity using CVSS-like criteria: exploitability, impact, and affected scope
Vulnerability Scanning
Scans codebase for security vulnerabilities including injection flaws, authentication issues, exposed secrets, and insecure configurations
Assess Severity
Rates each categorized finding by severity using structured exploitability, impact, and scope criteria
Categorize Findings
Groups raw scan findings into OWASP Top 10 categories for structured analysis
Plan Remediation
Generates specific fix recommendations with code examples, effort estimates, and dependency mapping
Scan Vulnerabilities
Instructs the LLM to perform a comprehensive vulnerability scan of the target codebase
Write Executive Report
Produces a two-part audit report: executive summary for leadership and detailed technical findings for engineers
OWASP Top 10 Reference
Reference card listing the OWASP Top 10 2021 categories with descriptions and common examples
Security Finding Template
Structured template for documenting individual security findings consistently across the audit
Requirements 1 service, 2 permissions, 3 data types
- LLM Service
- filesystem:read
- shell:execute
- source code
- pii
- credentials
Security Passed
Detected
- Services: llm-service
- Permissions: shell:execute
- Data Handling: pii
Version history 15 releases
GH#845 — republish with American English (en-US) content, completing the source-only GH#805 flip that never reached the Hub. Copy only — no functional or behaviour change.
GH#745 — declare per-step `output: {name, type}` on every execution step (vulnerabilities/list, categorised_findings/text, severity_assessment/text, remediation_plan/text, executive_report/text, polished_report/text, consistency_verdict/decision, compliance_verdict/decision). Lights up the #744 rich flow-map. Content-only; no bindings or logic changes.
Fix-forward after Row 3b v1.0.23 publish failure. The v1.0.23 per-skrpt CI's "Register version with Hub API" step failed because the consumer's source `manifest.id` (c9d5e32b…) did not match the D1 catalogue row's id (a80ac015…) — a legacy drift from before Action 6 (`0bcc5ae0`) made publish-skrpt.mjs Step 2 INSERT use `manifest.id` for the D1 id column. v1.0.24 reconciles the source `manifest.id` to the catalogue authoritative value (Row-5-equivalent for consumers) and republishes. Per Adj-1: no re-tag of v1.0.23; the orphaned GitHub release artefact stays inert (no D1 versions row, no consumer pinned it).
Wave 2: re-signed with canonical engine signing pipeline.
Signature fix — RELEASE_NOTES.md now included in integrity checksum.
Initial catalogue release with full structural and content-quality validation. All scanner checks pass.
Release notes unavailable for this version.
Release notes unavailable for this version.
Release notes unavailable for this version.
Release notes unavailable for this version.
Release notes unavailable for this version.
Release notes unavailable for this version.
Release notes unavailable for this version.
Release notes unavailable for this version.
Release notes unavailable for this version.
More from Developer
View all →Code Review Pipeline
Automated PR review with style checking, security scan, and structured feedback
Skrptiq-on-Skrptiq
Use Skrptiq to design, build, and publish new skrpts — a four-stage compound workflow chain that demonstrates multi-stage pipelines with human-in-the-loop gates
AI Project Orchestrator
Multi-agent coordination workflow that reasons over a pasted push summary + open-issues list: structured push review, likely-drift flagging, triage + issue-action planning, and a briefing — via a 3-way review loop (Architect → CTO → Orchestrator)