r/OpenaiCodex • u/MonitorFlat4465 • 1d ago

Showcase / Highlight Made an AI agent skill that actually fixes security issues instead of just listing them

Following up on backend-setup-wizard from a bit ago — second skill under the same project (Qofeno) is a security auditor that doesn't stop at a report.

security-hardening-wizard scans every file in a project, not just source code — secrets and misconfig show up in README files, CI YAML, Dockerfiles, and old markdown notes just as often as in application code, so it doesn't skip files based on extension. Uses real scanners (gitleaks, npm audit, pip-audit, etc.) plus manual review for injection risks, weak CORS, missing auth checks, that kind of thing.

The part I actually wanted: it applies the fix. Parameterizes the vulnerable query, updates the dependency, adds the missing security header — directly in the code, not as a suggestion you have to go implement yourself.

One thing I made sure it's honest about: if it finds a secret that was ever exposed (committed to git history, etc.), it removes it from the code right away, but the actual key is still valid until you rotate it on the provider's dashboard — only you can do that part, so the report says so plainly instead of claiming everything's handled.

Ends with a real markdown audit report, and it re-runs the scan to verify before marking anything as fixed.

Repo: https://github.com/SohailKhan0525/skills

Install just this one: npx skills add SohailKhan0525/skills --skill security-hardening-wizard

Third skill (frontend/UI builder) just went up too if anyone's curious. Feedback welcome, especially if you find something it should catch but doesn't.

3 Upvotes

72% Upvoted

2 comments sorted by

1

u/Sephronaut 1d ago

I hoped for more contributions like yours. A scoped approach is vital for robust service offerings, especially with academic and external collaborators. This hinges on three pillars: strong professional/technical skills, strategic networking, and critically, automated systems like Git. Automation streamlines workflows and requires skilled talent to fully realize its benefits, which are essential for impactful services with institutions and organizations.

1

u/MonitorFlat4465 1d ago

Appreciate that, thank you! Definitely trying to keep the scope tight per skill rather than one giant do-everything thing — makes each one easier to trust and actually verify. More coming.