Individual skill
security-audit
Runs a whole-application security audit - threat-model-lite scoping, dependencies and supply chain, secrets, authentication and authorization, input handling, transport and headers, logging, and infrastructure config - and delivers a severity-ranked findings report with reproduction steps and concrete fixes. Use when someone asks "audit our app's security", "are we ready for a pentest or SOC 2", "what are our biggest security holes", or is preparing for launch, an enterprise security questionnaire, or taking over an inherited codebase. Do NOT use for hunting flaw classes in a single diff or PR - use secure-code-review instead; for prioritizing an existing scanner or pentest report, use vulnerability-triage; for design-stage analysis before code exists, use threat-model-stride.
skills/security-audit/SKILL.md
Source commit 97a13607d669157a4a16d5ba79b77f208319f7b9
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 24
- Repository last updated
- Oct 13, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- claude Repository topic
- claude-skills Repository topic
- skill-me Repository topic
- security Derived category
- design Derived category
- operations Derived category
- devops Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
# Security Audit
A security audit asks, for a whole system: where would a motivated attacker get in first, and what would it cost? It is broader than code review - many real breaches start from a leaked key in git history, an admin panel without MFA, an unpatched edge dependency, or a public bucket, none of which appear in a diff. The costly mistake this skill prevents is auditing only the code you were shown, producing a long list of medium-severity lint, and missing the one system-level hole that is trivially exploitable from the internet.
## Operating procedure
Scope before scanning. A scan with no map of assets and entry points produces noise ranked by tool output instead of by attacker value.
### Step 1: Confirm authorization and rules of engagement
- Get written confirmation of what you may touch: repositories, environments, cloud accounts, live endpoints.
- Default to read-only analysis and non-destructive testing in non-production. No exploitation, fuzzing, or load against production without a named owner's approval.
- Record exclusions so the report does not imply coverage it lacks.
