---

name: security-baseline description: Audit and implement security best practices for GitHub repositories. USE THIS SKILL when user says "security audit", "check security", "add gitleaks", "secret scanning", "dependency audit", or needs security hardening. allowed-tools:

• Bash
• Read
• Write
• Edit
• Glob
• Grep

---

Security Baseline Skill

Purpose

Audit and implement security best practices for GitHub repositories, including secret scanning, dependency audits, and security hardening.

Triggers

• "audit repository security"
• "add secret scanning"
• "check for vulnerabilities"
• "security hardening"
• "add pre-commit hooks"
• "configure dependabot"

Usage

Run a security audit on any repository to identify gaps, then use the provided checklists and commands to implement security controls systematically.

Security Audit Checklist

GitHub Actions Security

• All actions SHA-pinned
• Minimal permissions: declared
• No secrets in logs
• OIDC instead of static credentials
• Untrusted input sanitized

Repository Security

• Branch protection enabled
• Required reviews
• Status checks required
• Force pushes blocked
• CODEOWNERS defined

Secret Management

• No hardcoded secrets
• .env files ignored
• Gitleaks configured
• GitHub secret scanning enabled
• Pre-commit hooks installed

Dependency Security

• Dependabot enabled
• Lock files committed
• No critical CVEs
• Regular audits scheduled

SHA Pinning Validation

Copy# Check for unpinned actions
grep -rn "uses:.*@v[0-9]" .github/workflows/
grep -rn "uses:.*@main" .github/workflows/

# Validate all workflows
./scripts/validate-sha-pinning.sh .github/workflows/

Safe Permission Patterns

Copy# Minimal (default)
permissions:
  contents: read

# For PR comments
permissions:
  contents: read
  pull-requests: write

# For releases
permissions:
  contents: write
  packages: write

OIDC Authentication

Copy# AWS
permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@...
    with:
      role-to-assume: arn:aws:iam::123456789:role/github-actions
      aws-region: us-east-1

Secret Scanning Setup

Gitleaks Configuration

Copy# gitleaks.toml
[allowlist]
paths = [
  '''\.example$''',
  '''test/fixtures''',
]

Pre-commit Hook

Copy# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

Dependency Audit Commands

Copy# Python
uv pip audit

# Node.js
pnpm audit

# Go
go list -json -m all | nancy sleuth

# Rust
cargo deny check advisories

Required Security Files

Vulnerability Response

Quick Security Commands

Copy# Run gitleaks
gitleaks detect --source . --verbose

# Check git history
gitleaks detect --source . --log-opts="--all"

# Find workflows without permissions
for f in .github/workflows/*.yml; do
  grep -q "^permissions:" "$f" || echo "Missing: $f"
done