security-audit
Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
Best use case
security-audit is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
Teams using security-audit should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/security-audit/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How security-audit Compares
| Feature / Agent | security-audit | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Security Auditing Workflow Bundle ## Overview Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation. ## When to Use This Workflow Use this workflow when: - Performing security audits on web applications - Testing API security - Conducting penetration tests - Scanning for vulnerabilities - Hardening application security - Compliance security assessments ## Workflow Phases ### Phase 1: Reconnaissance #### Skills to Invoke - `scanning-tools` - Security scanning - `shodan-reconnaissance` - Shodan searches - `top-web-vulnerabilities` - OWASP Top 10 #### Actions 1. Identify target scope 2. Gather intelligence 3. Map attack surface 4. Identify technologies 5. Document findings #### Copy-Paste Prompts ``` Use @scanning-tools to perform initial reconnaissance ``` ``` Use @shodan-reconnaissance to find exposed services ``` ### Phase 2: Vulnerability Scanning #### Skills to Invoke - `vulnerability-scanner` - Vulnerability analysis - `security-scanning-security-sast` - Static analysis - `security-scanning-security-dependencies` - Dependency scanning #### Actions 1. Run automated scanners 2. Perform static analysis 3. Scan dependencies 4. Identify misconfigurations 5. Document vulnerabilities #### Copy-Paste Prompts ``` Use @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities ``` ``` Use @security-scanning-security-dependencies to audit dependencies ``` ### Phase 3: Web Application Testing #### Skills to Invoke - `top-web-vulnerabilities` - OWASP vulnerabilities - `sql-injection-testing` - SQL injection - `xss-html-injection` - XSS testing - `broken-authentication` - Authentication testing - `idor-testing` - IDOR testing - `file-path-traversal` - Path traversal - `burp-suite-testing` - Burp Suite testing #### Actions 1. Test for injection flaws 2. Test authentication mechanisms 3. Test session management 4. Test access controls 5. Test input validation 6. Test security headers #### Copy-Paste Prompts ``` Use @sql-injection-testing to test for SQL injection vulnerabilities ``` ``` Use @xss-html-injection to test for cross-site scripting ``` ``` Use @broken-authentication to test authentication security ``` ### Phase 4: API Security Testing #### Skills to Invoke - `api-fuzzing-bug-bounty` - API fuzzing - `api-security-best-practices` - API security #### Actions 1. Enumerate API endpoints 2. Test authentication/authorization 3. Test rate limiting 4. Test input validation 5. Test error handling 6. Document API vulnerabilities #### Copy-Paste Prompts ``` Use @api-fuzzing-bug-bounty to fuzz API endpoints ``` ### Phase 5: Penetration Testing #### Skills to Invoke - `pentest-commands` - Penetration testing commands - `pentest-checklist` - Pentest planning - `ethical-hacking-methodology` - Ethical hacking - `metasploit-framework` - Metasploit #### Actions 1. Plan penetration test 2. Execute attack scenarios 3. Exploit vulnerabilities 4. Document proof of concept 5. Assess impact #### Copy-Paste Prompts ``` Use @pentest-checklist to plan penetration test ``` ``` Use @pentest-commands to execute penetration testing ``` ### Phase 6: Security Hardening #### Skills to Invoke - `security-scanning-security-hardening` - Security hardening - `auth-implementation-patterns` - Authentication - `api-security-best-practices` - API security #### Actions 1. Implement security controls 2. Configure security headers 3. Set up authentication 4. Implement authorization 5. Configure logging 6. Apply patches #### Copy-Paste Prompts ``` Use @security-scanning-security-hardening to harden application security ``` ### Phase 7: Reporting #### Skills to Invoke - `reporting-standards` - Security reporting #### Actions 1. Document findings 2. Assess risk levels 3. Provide remediation steps 4. Create executive summary 5. Generate technical report ## Security Testing Checklist ### OWASP Top 10 - [ ] Injection (SQL, NoSQL, OS, LDAP) - [ ] Broken Authentication - [ ] Sensitive Data Exposure - [ ] XML External Entities (XXE) - [ ] Broken Access Control - [ ] Security Misconfiguration - [ ] Cross-Site Scripting (XSS) - [ ] Insecure Deserialization - [ ] Using Components with Known Vulnerabilities - [ ] Insufficient Logging & Monitoring ### API Security - [ ] Authentication mechanisms - [ ] Authorization checks - [ ] Rate limiting - [ ] Input validation - [ ] Error handling - [ ] Security headers ## Quality Gates - [ ] All planned tests executed - [ ] Vulnerabilities documented - [ ] Proof of concepts captured - [ ] Risk assessments completed - [ ] Remediation steps provided - [ ] Report generated ## Related Workflow Bundles - `development` - Secure development practices - `wordpress` - WordPress security - `cloud-devops` - Cloud security - `testing-qa` - Security testing
Related Skills
security-scanning-security-hardening
Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
security-scanning-security-dependencies
You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, ass...
security-scan
Comprehensive security scanning for CVE vulnerabilities, OWASP Top 10 code patterns, and dependency audits. Use when the user wants to check code security, find vulnerabilities, or audit dependencies.
security-reviewer
Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews.
security-review
Run a targeted security audit on specified files or modules. Uses OWASP-informed checks, dependency vulnerability scanning, and auth/input validation review. Use for security audits, vulnerability checks, or before deploying sensitive code. Keywords: security, audit, vulnerability, OWASP, CVE, secrets, injection, XSS, auth, authentication, authorization
security-review-pr
PR/branch security review focused on HIGH-CONFIDENCE vulnerabilities with minimal false positives. Uses git diff analysis and sub-task parallelization.
security-review-audit
Full codebase security audit with OWASP Top 10 guidance, language-specific patterns, checklists, and fix examples. Use for comprehensive audits split by module/area.
security-requirement-extraction
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
security
Information security expertise for cybersecurity frameworks (NIST, ISO 27001), security architecture, incident response, vulnerability management, identity management, and cloud security. Use when designing security programs, responding to incidents, or assessing vulnerabilities.
security-hardening
World-class application security - OWASP Top 10, secure coding patterns, and the battle scars from security incidents that could have been preventedUse when "security, secure, vulnerability, injection, xss, csrf, authentication, authorization, owasp, encryption, secret, password, token, sanitize, validate, escape, encode, harden, security, owasp, injection, xss, csrf, authentication, authorization, encryption, secrets, hardening" mentioned.
Security Engineer
Implement security best practices across the application stack. Use when securing APIs, implementing authentication, preventing vulnerabilities, or conducting security reviews. Covers OWASP Top 10, auth patterns, input validation, encryption, and security monitoring.
security-core
Comprehensive application security expertise covering authentication, authorization, OWASP Top 10, and security best practices. Use when (1) Implementing authentication (JWT, OAuth2, sessions, OAuth for CLI/TUI/desktop apps), (2) Adding authorization (RBAC, ABAC, RLS with Supabase/PostgreSQL), (3) Security auditing code or infrastructure, (4) Setting up security infrastructure (headers, CORS, CSP, rate limiting), (5) Managing secrets and credentials, (6) Preventing OWASP Top 10 vulnerabilities (injection, XSS, CSRF, etc.), (7) Reviewing code for security issues, (8) Configuring secure web applications in TypeScript, Python, or Rust. Automatically triggered when working with authentication/authorization systems, security reviews, or addressing security vulnerabilities.