Security auditor saas

Skill batterfried-philosophy172/Agent-Startup-Skills/skills/security-auditor-saas

Build SaaS products using an 8-phase AI agent pipeline with mandatory approval gates for Antigravity, Claude Code, and Codex.

Install

npx -y skills add batterfried-philosophy172/Agent-Startup-Skills --skill security-auditor-saas

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Application security agent that audits code for OWASP Top 10 vulnerabilities, hardcoded secrets, and common security flaws. Triggers on: security audit, vulnerability scan, OWASP check, security review, penetration test, hardening.

SKILL.md

3.1 KB, as published. Nobody here has run it

Security Auditor — Hardening Agent

Purpose

Identify and remediate security vulnerabilities before the product is deployed. Prevent data breaches, unauthorized access, and common attack vectors.

When to Use

After code and tests are complete
Before deployment planning
When the user asks "is this code secure?"

Audit Checklist (OWASP Top 10 Aligned)

1. Injection (SQL, NoSQL, Command)

All database queries use parameterized statements or ORM
No string concatenation in queries
User input is never passed directly to system commands

2. Broken Authentication

Passwords are hashed with bcrypt/argon2 (never plain text, never MD5/SHA)
Sessions expire after a reasonable timeout
Login has rate limiting or brute-force protection
Password reset tokens are single-use and time-limited

3. Sensitive Data Exposure

No secrets in source code (API keys, passwords, tokens)
.env files are in .gitignore
HTTPS is enforced in production
Sensitive data is not logged

4. Broken Access Control

Users cannot access other users' data by changing IDs in URLs
Admin routes are protected with role checks
API endpoints verify the requesting user's permissions

5. Security Misconfiguration

CORS is configured to allow only known origins
Debug mode is disabled in production config
Default credentials are changed
Error messages do not expose stack traces to users

6. Cross-Site Scripting (XSS)

All user-generated content is escaped/sanitized before rendering
Content-Security-Policy headers are set
React/Vue/Angular auto-escaping is not bypassed (no dangerouslySetInnerHTML)

7. Cross-Site Request Forgery (CSRF)

CSRF tokens are used on state-changing forms
SameSite cookie attribute is set

8. Insecure Dependencies

No known vulnerable dependencies (check npm audit / pip audit)
Dependencies are pinned to specific versions

9. Insufficient Logging

Failed login attempts are logged
Access to sensitive data is logged
Logs do not contain passwords or tokens

10. Input Validation

All inputs have type, length, and format validation
File uploads are restricted by type and size
Email addresses are validated

Output

Produce a security_audit.md with:

#	Finding	Severity	Location	Remediation
1	Hardcoded API key	CRITICAL	src/lib/api.js:14	Move to .env

Rules

Critical/High findings MUST be fixed before deployment.
Present fixes to the CEO for approval.
Re-audit after fixes are applied.

Exit Criteria

All 10 OWASP categories are checked
All Critical/High findings are remediated
Audit report is complete with pass/fail for each category

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.