Security audit

Skill kasimmj/claude-skills-mega/skills/security-audit

🤖 The ultimate curated collection of production-ready Claude Code skills with a framework to build your own.

Install

npx -y skills add kasimmj/claude-skills-mega --skill security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Run an OWASP-style security audit on the current diff, the working tree, or a specified path. Flags injection, auth flaws, secrets, insecure deserialization, and misconfigurations.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.1 KB, as published. Nobody here has run it

Security Audit Skill

You are performing a security audit. Output a structured report — not just prose.

Step 1 — Define the scope

Ask the user (or infer) the scope:

Diff — current uncommitted changes (default if there are uncommitted changes)
Branch — git diff main...HEAD
Repo — full working tree
Path — a specific directory or file

Step 2 — Run the audit

Walk through the OWASP Top 10 (2021) categories systematically:

A01 Broken Access Control — missing authz checks, IDOR, path traversal
A02 Cryptographic Failures — weak hashing (MD5, SHA1), hardcoded keys, missing TLS
A03 Injection — SQL, NoSQL, OS command, LDAP, XSS — search for unparameterized string interpolation in queries, untrusted input in exec/eval
A04 Insecure Design — race conditions in critical flows (payments, account changes)
A05 Security Misconfiguration — debug=true in prod, default creds, exposed admin panels, permissive CORS
A06 Vulnerable Components — outdated deps with known CVEs (cross-reference package.json/requirements.txt/go.mod)
A07 Identification & Authentication Failures — weak password policy, missing rate-limit on login, JWT with alg=none, sessions without timeout
A08 Software & Data Integrity Failures — unsigned updates, insecure deserialization (pickle, YAML.load, Java ObjectInputStream)
A09 Logging & Monitoring Failures — sensitive data in logs, missing audit trails
A10 SSRF — unvalidated URL fetches that could hit internal services (169.254.169.254, localhost)

Step 3 — Look for secrets

Search for committed secrets using these patterns:

aws_secret, AKIA[0-9A-Z]{16}, ghp_[A-Za-z0-9]{36}, sk-[A-Za-z0-9]{32,}
password\s*=\s*['"], api[_-]?key\s*=\s*['"]
.env, .pem, .key files that should be gitignored

Step 4 — Output the report

SECURITY AUDIT REPORT
─────────────────────
Scope:    <scope>
Files:    <N files scanned>

🔴 CRITICAL (N)
  - <file:line> — <issue> — <fix>

🟠 HIGH (N)
  - <file:line> — <issue> — <fix>

🟡 MEDIUM (N)
  - <file:line> — <issue> — <fix>

🟢 LOW (N)
  - <file:line> — <issue> — <fix>

✓ PASSED CHECKS
  - <category>: clean

When NOT to use

Repos with no source code (docs-only)
When the user wants a code review (use code-review instead)
When the user wants a license scan (use license-check)

Failure modes

⚠️ A clean report doesn't mean the code is secure — it means these checks passed.
⚠️ Always recommend a real third-party scanner (Semgrep, Snyk, Trivy) for production releases.