Does it support different output formats?

Yes, the skill supports human-readable text, structured JSON for automation, and Markdown for documentation purposes.

Can it detect if I already have security scanners installed?

Yes, it checks your system PATH for common tools like Semgrep, Gitleaks, Bandit, and Trivy to see what's already available for use.

Does this skill run any destructive tests?

No, it only reads configuration files and source code patterns to provide recommendations; it does not execute active exploits or modify your source code.

What does the AppSec 'start' skill actually do?

It performs a non-invasive scan of your project files to identify the tech stack, data types, and architecture, then suggests which specific security tools you should run next.

Why is 'secrets' always the top priority in the recommendation?

Hardcoded secrets are the most common and damaging security mistake in modern development, making their detection the highest priority for any codebase assessment.

AppSec Project Assessment

Name: AppSec Project Assessment
Author: florianbuetow

byflorianbuetow

•

Security & Testing

Analyzes codebase architecture, tech stacks, and data sensitivity to recommend a prioritized security testing strategy.

The AppSec Start skill serves as the intelligence-gathering phase for any security audit. It automatically inspects project manifests, source code, and environment configurations to identify languages, frameworks, and sensitive data patterns such as PII or financial records. By mapping your project's unique architecture against available security scanners, it generates a tailored, prioritized roadmap of security actions, ensuring you address the most critical risks—like exposed secrets—before moving to specialized depth-scans.

Key Features

01Sensitive data detection (PII, Financial, Health, Auth)

026 GitHub stars

03Automated tech stack and framework fingerprinting

04Prioritized security tool recommendations with actionable rationale

05Architecture-specific vulnerability surface mapping

06Local security scanner discovery and validation

Use Cases

01Onboarding a new project for a comprehensive security audit

02Determining which security tools are compatible with your current environment

03Identifying missing security configurations and best practices

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code start

For use in Claude.ai and ChatGPT

Download Skill