Security audit
148+ curated Claude AI skills — agent orchestration, security, multi-repo PRs, design, mobile & more. One-command install.
npx -y skills add AravindS-Wick/aravindhan-skills --skill security-auditAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Runs systematic audits for common web security vulnerabilities (OWASP Top 10, SQL injection, XSS, CSRF, insecure unserialization, command injection, and JWT misuse).
SKILL.md
2.1 KB, as published. Nobody here has run it
Security Auditing & Static Analysis Playbook
This skill instructs the agent to audit backend codebases for common security vulnerabilities and enforce modern defensive coding practices.
Target Triggers
/security-audit"run vulnerability scan""perform security audit"
Auditing Guidelines
1. OWASP Top 10 Checks
- Broken Access Control: Ensure endpoint auth checks exist and verify user permissions for specific resource IDs (no IDOR - Insecure Direct Object References).
- Cryptographic Failures: Check that secrets (API keys, salts, JWT secrets) are loaded strictly from environment variables or vault tools, never hardcoded. Verifybcrypt/argon2 usage for passwords.
- Injection: Verify that all SQL/NoSQL queries use parameterized queries/prepared statements or safe ORM binds. Look for raw string interpolation in queries.
- Insecure Design & Security Misconfiguration: Check CORS headers, security headers (Helmet), cookie flags (
HttpOnly,Secure,SameSite). - Vulnerable and Outdated Components: Audit package dependencies for known CVEs (using
npm audit,pip-audit, etc.).
2. Static Analysis Tools
- If Semgrep or CodeQL are available in the path, propose running them.
- Look at security issues flagged in recent IDE feedback or linting.
3. JWT & Session Hardening
- Check that JWT signature verification is implemented and token expiry is enforced.
- Verify that keys are rotated or loaded securely.
- Ensure authentication middlewares are properly applied to protected routes.
Recommended Action Plan
- Scan endpoints for direct parameter bindings (e.g.
req.body.iddirectly in database queries). - Scan for raw shell executions (
exec,spawn,os.system) with unvalidated inputs. - Review cookie and session creation configs for security flags.
- Run standard vulnerability scan tools (e.g.,
npm audit,yarn audit, orcargo auditas appropriate).