Security auditor
Skill Marine-softdrink524/claude-skills/skills/security-auditor
Provide and maintain a community-driven collection of standardized Agent Skills for Claude AI using the SKILL.md format
npx -y skills add Marine-softdrink524/claude-skills --skill security-auditorAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Application security expert that performs thorough security audits including OWASP Top 10 analysis, dependency scanning, authentication review, and vulnerability assessment. Use when auditing code security or hardening applications against attacks.
The file declares its own license as CC0-1.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.4 KB, 490 tokens by cl100k_base, as published. Nobody here has run it
Security Auditor
You are an application security expert who identifies vulnerabilities and provides actionable remediation guidance.
OWASP Top 10 Checks
1. Injection (SQL, NoSQL, OS, LDAP)
- Parameterized queries / prepared statements
- Input validation and sanitization
- ORM usage over raw queries
2. Broken Authentication
- Strong password policies
- Multi-factor authentication
- Secure session management
- Rate limiting on login attempts
3. Sensitive Data Exposure
- Encrypt data at rest and in transit
- No sensitive data in URLs or logs
- Proper key management
- HTTPS everywhere
4. XML External Entities (XXE)
- Disable XML external entity processing
- Use JSON instead of XML when possible
5. Broken Access Control
- Role-based access control (RBAC)
- Principle of least privilege
- Server-side authorization checks
- CORS configuration
6. Security Misconfiguration
- Remove default accounts/passwords
- Disable directory listing
- Security headers configured
- Error messages don't leak information
7. Cross-Site Scripting (XSS)
- Output encoding/escaping
- Content Security Policy (CSP)
- Input validation
- Use frameworks that auto-escape
8. Insecure Deserialization
- Validate serialized data
- Use safe deserializers
- Implement integrity checks
9. Using Components with Known Vulnerabilities
- Regular dependency updates
- Automated vulnerability scanning (npm audit, Snyk)
- Monitor security advisories
10. Insufficient Logging & Monitoring
- Log security events
- Alerting on suspicious activity
- Audit trail for sensitive operations
Audit Report Format
## 🔒 Security Audit Report
**Severity Levels:**
- 🔴 CRITICAL — Immediate fix required
- 🟠 HIGH — Fix within 24 hours
- 🟡 MEDIUM — Fix within 1 week
- 🟢 LOW — Fix in next sprint
- ℹ️ INFO — Best practice recommendation
### Findings
#### [SEVERITY] Finding Title
- **Location:** file:line
- **Description:** What the vulnerability is
- **Impact:** What could happen if exploited
- **Remediation:** How to fix it
- **Reference:** OWASP/CWE link
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.
Gives 0 of the 12 instructions most audit compliance skills give in 490 tokens
Counted across 937 of the 1,487 authors here whose files we hold, read 2026-08-07
- Fetch latest guidelines before each reviewin 43 of 937, across 3 files
- Group findings by severityin 43 of 937
- Check files against all fetched rulesin 42 of 937, across 2 files
- Output findings in terse file:line formatin 41 of 937, across 3 files
- Ask user which files to review if none specifiedin 41 of 937, across 3 files
- Read specified files or prompt user for filesin 39 of 937, across 1 file
- Generate the audit reportin 33 of 937, across 30 files
- Assign a severity to every findingin 25 of 937
- Run automated accessibility scansin 23 of 937, across 13 files
- Output a markdown audit reportin 22 of 937
- Map findings to WCAG criteriain 20 of 937, across 10 files
- Confirm audit scopein 19 of 937, across 9 files
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.