Following up on backend-setup-wizard from a bit ago — second skill under the same project (Qofeno) is a security auditor that doesn’t stop at a report. security-hardening-wizard scans every file in a project, not just source code — secrets and misconfig show up in README files, CI YAML, Dockerfiles, and old markdown notes just as often as in application code, so it doesn’t skip files based on extension. Uses real scanners (gitleaks, npm audit, pip-audit, etc.) plus manual review for injection risks, weak CORS, missing auth checks, that kind of thing. The part I actually wanted: it applies the fix. Parameterizes the vulnerable query, updates the dependency, adds the missing security header — directly in the code, not as a suggestion you have to go implement yourself. One thing I made sure it’s honest about: if it finds a secret that was ever exposed (committed to git history, etc.), it removes it from the code right away, but the actual key is still valid until you rotate it on the provider’s dashboard — only you can do that part, so the report says so plainly instead of claiming everything’s handled. Ends with a real markdown audit report, and it re-runs the scan to verify before marking anything as fixed. Repo: https://github.com/SohailKhan0525/skills Install just this one: npx skills add SohailKhan0525/skills --skill security-hardening-wizard Third skill (frontend/UI builder) just went up too if anyone’s curious. Feedback welcome, especially if you find something it should catch but doesn’t. submitted by /u/MonitorFlat4465
Originally posted by u/MonitorFlat4465 on r/ClaudeCode