Security audit

Skill AmanKrSahu/zeroday-auditor/skills/security-audit

An enterprise-grade, multi-specialist engineering audit plugin for Claude Code.

Install

npx -y skills add AmanKrSahu/zeroday-auditor --skill security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when the user wants a focused application security review of a codebase — 'do a security audit', 'security review', 'pentest this', 'find vulnerabilities', 'check for OWASP issues', 'is my auth/API secure?', 'review this for injection/XSS/CSRF/IDOR/secrets'. Produces a single evidence-backed security report (security-audit.md) with OWASP/CWE-referenced findings, a security score, and a prioritized remediation order. For a full multi-dimension audit use zeroday-auditor instead. Analysis only; never modifies source.

SKILL.md

4.4 KB, as published. Nobody here has run it

Security Audit

Perform a focused, professional application-security review as a Principal Cybersecurity Engineer + Senior AppSec Engineer. Output one self-contained report, security-audit.md, in the repository root. Analysis only — never modify source.

The rule that keeps this credible: every finding is backed by code you have read, and every Critical/High is re-verified against source before you publish it. Auditors lose trust by reporting plausible-but-wrong issues. If you cannot confirm something, write "Insufficient evidence to conclude." — never fabricate or inflate severity.

Workflow

Understand the security surface. Map the repo; read the entrypoint (CORS/headers/middleware order), auth/session/user services and controllers, JWT/crypto/cookie/hashing utils, passport/auth strategies, auth middleware, validators, mailer, OAuth/OIDC/SSO handlers, .env/.env.example, .gitignore/.dockerignore, ORM schema, Docker/CI config. Note the stack, auth flow, and trust boundaries.
Dispatch specialist passes (in one message, concurrently) using the audit-specialist agent (fallback general-purpose), each READ-ONLY and required to return findings with exact file:line + verbatim evidence:
- Core AppSec — authn/authz, broken access control/IDOR/privilege-escalation, JWT flaws, session/cookie/CSRF, weak hashing, missing input validation, brute-force gaps, timing attacks, MFA bypass, info disclosure.
- Surface & infra — CORS/security headers, SSRF/open-redirect, dependency vulnerabilities, secrets in repo/image (run git ls-files | grep -iE "\.env|secret|key" and report exactly what is tracked), insecure Docker (root, secrets in image), datastore auth/TLS, sensitive-data logging, missing rate limits, email/injection.
- Split further for large repos; combine for small ones.
Verify the load-bearing findings yourself. Open the file and confirm each Critical/High is real. Downgrade over-rated items with a written reason (e.g. "rated Critical for alg-confusion, but all secrets are symmetric HMAC and the lib rejects alg:none by default → Low"). Reconcile duplicates into one canonical finding each.
Write security-audit.md (structure below).

Areas to cover

Authentication · Authorization · Session management · JWT · Cookies · CSRF · XSS · SQL/NoSQL/Command injection · SSRF · RCE · IDOR · Secrets & env config · Dependency vulnerabilities · File upload/download · Logging · Rate limiting · API security · Security headers · Encryption · CORS. Record findings where they exist and note areas reviewed and found sound.

Finding format

Group findings by severity (Critical → High → Medium → Low → Informational). Rate by realistic impact × likelihood in this system — not category prestige. Give each a stable ID SEC-<C|H|M|L|I>-NNN. For each:

SEC-X-NNN — Title
Severity (+ one-line justification)
Description — what the flaw is
Why it is dangerous — the concrete attack scenario
Location — file · function · endpoint/component
Evidence — verbatim snippet with file:line
Recommendation + short improved-code example where useful
References — OWASP / CWE / CVE, when relevant

Report structure

# <Project> — Security Audit
(scope, method, date; note if .env is tracked/committed vs. gitignored)
# Summary   (table of counts by severity; fix-first list)
# Critical Severity   (findings)
# High Severity
# Medium Severity
# Low Severity / Informational
# What's done well   (genuine strengths)
# Security Summary   (totals; Security Score /10 with justification; prioritized remediation order by ID)

Finish by telling the user the headline risks, counts by severity, and the top 3 fixes. Confirm source is untouched (git status shows only security-audit.md).