ralph-security_skill

Overview

This skill performs a comprehensive, evidence-driven security audit across 100 focused iterations (~30–60 minutes). It balances depth and speed to surface critical findings across OWASP Top 10, authentication, secrets, infrastructure, and code quality. The output is a reproducible per-iteration log and a final consolidated report for triage and remediation.

How this skill works

The auditor runs a deterministic 100-iteration loop where each iteration executes one specific check, verifies the finding against code and libraries, and records a structured result. Every 10 iterations the tool saves progress to a report file; at completion it generates a final scorecard and prioritized recommendations. The process enforces single-check iterations, evidence-first verification, and clear severity/confidence levels.

When to use it

• Weekly security check for active projects
• New project onboarding to baseline security posture
• Pre-release audit before major deployments
• When asked: 'security audit', 'ralph security', or 'audit this project'
• To regularly validate OWASP Top 10 and infrastructure controls

Best practices

• Run against a recent, synced clone of the repo and include CI/CD manifests
• Provide environment samples (.env.example) or CI variables for accurate verification
• Run with --resume when interrupted to avoid duplicated work
• Triage NEEDS_REVIEW findings by inspecting the referenced code or libraries
• Save and version the generated .ralph-report.md for audit trails

Example use cases

• Automated weekly scan in CI to detect newly introduced vulnerabilities
• Security review during sprint handoff for a new microservice
• Pre-release checklist to catch auth, secrets, and TLS regressions
• Onboarding security baseline for archived or forked repositories
• Targeted focus runs (e.g., --focus=secrets or --phase=4) to validate specific risk areas