ojuliocouto

Skill Auditor Seguranca

Name: Skill Auditor Seguranca
Author: ojuliocouto

Security community

SOURCE https://github.com/ojuliocouto/skill-auditor-seguranca

Description

Executable security and LGPD gate for AI-built projects. Scans for exposed secrets, .env leaks, Supabase service_role in frontend, personal data in logs. Built for non-developers. Claude Code skill. By Julio Couto - iAutomate.

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

README

auditor-seguranca

Security and LGPD (Brazilian data protection law) auditor for projects built with AI assistance. A Claude Code skill that **runs** on the project and reports what is exposed, instead of handing the user a passive checklist. Built for people who have never been developers.

What it is

An executable gate: scripts/varredura.py scans the project and exits red (code 2) on any critical finding, so "done" cannot be declared over an exposed secret.
A guided flow: the skill instructs the AI agent to explain every finding in plain language (each one has a ready-made lay explanation with an analogy in references/achados-explicados.md), fix it together with the user, and re-run until green.
A deploy check: scripts/checar_deploy.py tests a published site for publicly accessible .env / .git files and missing security headers. GET requests only.

What it is NOT

Not a pentest. It reads code at rest and knocks on the front door of a site. It does not test authorization logic and it does not attack anything.
Not legal advice. LGPD guidance here is technical; legal calls (lawful basis, public sector, sensitive data) belong to a lawyer/DPO, and the skill says so explicitly.
A clean scan means "this scan found nothing", never "the project is secure". The skill is instructed to say exactly that.

What the scanner catches

Finding	Severity
API keys / tokens / private keys hardcoded (OpenAI, Groq, Google, GitHub, AWS, Stripe, Slack, Notion, JWT, passwords)	CRITICAL
`.env` tracked by git, or present anywhere in git history	CRITICAL
Supabase `service_role` key in frontend code	CRITICAL
`.gitignore` not ignoring `.env`	HIGH
Personal data (CPF, email, phone, password fields) being logged	HIGH
Literal CPF (Brazilian ID) in code	HIGH
CORS open to `*`	MEDIUM
Admin page with no sign of authentication (heuristic)	VERIFY
Supabase in use → RLS must be check