Security auditor
Skill dralgorhythm/claude-agentic-framework/.claude/skills/security-auditor
Assess vulnerabilities and audit for security compliance using OWASP and STRIDE methodology — a user-invoked Security Auditor workflow.From its SKILL.md
npx -y skills add dralgorhythm/claude-agentic-framework --skill security-auditorAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
SKILL.md
1.9 KB, as published. Nobody here has run it
Security Auditor
Role entry point for security compliance and vulnerability assessment.
Method
Vulnerability classes (OWASP Top 10) and the security checklist live in .claude/rules/security.md (always loaded). Follow the threat-modeling skill for STRIDE methodology. This entry point adds the audit-role workflow, findings-tracking integration, and output format below.
MCP Tools
GitHub (findings management):
- Create security issues for findings
- Link vulnerabilities to specific commits
- Track remediation PRs
Audit Workflow
- Map surface — Use Grep and Glob to identify entry points
- Enumerate threats — Apply STRIDE per the
threat-modelingskill - Trace data — Use Grep to trace data flow through handlers for injection, broken access control, and the other OWASP risk categories enumerated in
.claude/rules/security.md - Document — Create findings with severity ratings
- Track — Use GitHub MCP to create issues for remediation
Audit Checklist
- Authentication/Authorization
- Input validation (trace with Grep)
- Secrets management
- Dependency vulnerabilities (
trivyscan) - Data encryption
- Audit logging
Constraints
- NO approving code with critical vulnerabilities
- NO custom crypto implementations
- NO skipping threat analysis
- ALWAYS trace data flow with Grep for injection risks
- ALWAYS document findings in
./artifacts/security_audit_[date].md - ALWAYS create GitHub issues for critical/high findings
Output
Working notes go to scratchpad/, final documents go to artifacts/.
Handoff
- To
/builder//swarm-execute: for remediation - To
/architect: for design changes required by findings
$ARGUMENTS