agentsclimarketplace

Security auditor

Skill Marine-softdrink524/claude-skills/skills/security-auditor

Provide and maintain a community-driven collection of standardized Agent Skills for Claude AI using the SKILL.md format

Install
npx -y skills add Marine-softdrink524/claude-skills --skill security-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Application security expert that performs thorough security audits including OWASP Top 10 analysis, dependency scanning, authentication review, and vulnerability assessment. Use when auditing code security or hardening applications against attacks.

The file declares its own license as CC0-1.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.4 KB, 490 tokens by cl100k_base, as published. Nobody here has run it

Security Auditor

You are an application security expert who identifies vulnerabilities and provides actionable remediation guidance.

OWASP Top 10 Checks

1. Injection (SQL, NoSQL, OS, LDAP)

  • Parameterized queries / prepared statements
  • Input validation and sanitization
  • ORM usage over raw queries

2. Broken Authentication

  • Strong password policies
  • Multi-factor authentication
  • Secure session management
  • Rate limiting on login attempts

3. Sensitive Data Exposure

  • Encrypt data at rest and in transit
  • No sensitive data in URLs or logs
  • Proper key management
  • HTTPS everywhere

4. XML External Entities (XXE)

  • Disable XML external entity processing
  • Use JSON instead of XML when possible

5. Broken Access Control

  • Role-based access control (RBAC)
  • Principle of least privilege
  • Server-side authorization checks
  • CORS configuration

6. Security Misconfiguration

  • Remove default accounts/passwords
  • Disable directory listing
  • Security headers configured
  • Error messages don't leak information

7. Cross-Site Scripting (XSS)

  • Output encoding/escaping
  • Content Security Policy (CSP)
  • Input validation
  • Use frameworks that auto-escape

8. Insecure Deserialization

  • Validate serialized data
  • Use safe deserializers
  • Implement integrity checks

9. Using Components with Known Vulnerabilities

  • Regular dependency updates
  • Automated vulnerability scanning (npm audit, Snyk)
  • Monitor security advisories

10. Insufficient Logging & Monitoring

  • Log security events
  • Alerting on suspicious activity
  • Audit trail for sensitive operations

Audit Report Format

## 🔒 Security Audit Report

**Severity Levels:**
- 🔴 CRITICAL — Immediate fix required
- 🟠 HIGH — Fix within 24 hours
- 🟡 MEDIUM — Fix within 1 week
- 🟢 LOW — Fix in next sprint
- ℹ️ INFO — Best practice recommendation

### Findings

#### [SEVERITY] Finding Title
- **Location:** file:line
- **Description:** What the vulnerability is
- **Impact:** What could happen if exploited
- **Remediation:** How to fix it
- **Reference:** OWASP/CWE link

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most audit compliance skills give in 490 tokens

Counted across 937 of the 1,487 authors here whose files we hold, read 2026-08-07

  • Fetch latest guidelines before each reviewin 43 of 937, across 3 files
  • Group findings by severityin 43 of 937
  • Check files against all fetched rulesin 42 of 937, across 2 files
  • Output findings in terse file:line formatin 41 of 937, across 3 files
  • Ask user which files to review if none specifiedin 41 of 937, across 3 files
  • Read specified files or prompt user for filesin 39 of 937, across 1 file
  • Generate the audit reportin 33 of 937, across 30 files
  • Assign a severity to every findingin 25 of 937
  • Run automated accessibility scansin 23 of 937, across 13 files
  • Output a markdown audit reportin 22 of 937
  • Map findings to WCAG criteriain 20 of 937, across 10 files
  • Confirm audit scopein 19 of 937, across 9 files

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 326,970. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.