agentsclimarketplace

Security audit

Skill MuhammedZohaib/patchman/skills/security-audit

Defensive AI security audit skill for Claude and Codex. Reviews codebases and web apps for OWASP Top 10, auth and authorization flaws, business logic bugs, tenant isolation gaps, insecure defaults, secret leaks, and ORM or N+1 query issues, then produces clear remediation guidance.

Install
npx -y skills add MuhammedZohaib/patchman --skill security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Conduct authorized defensive security audits of codebases and web applications. Use for broad appsec review across OWASP, authz, business logic, SSRF, XSS, CSRF, injection, file upload, secrets, logging, and tenant isolation. Produces structured findings with severity, confidence, evidence, and safe remediation guidance.

SKILL.md

1.9 KB, as published. Nobody here has run it

Security Audit

When to use

Use this skill when the user wants a full security review of a repository, service, or application slice.

Default behavior

  • stay in read-first mode unless the user explicitly asks for a patch
  • reason from framework and architecture conventions
  • flag likely vulnerabilities and insecure defaults
  • explain exploitability in safe, non-weaponized language
  • ask for missing deployment or authorization context when needed

Coverage map

  • broken access control and IDOR
  • authentication, session, cookie, token, and reset flaws
  • business logic abuse paths
  • XSS, CSRF, SSRF, injection, unsafe deserialization
  • file upload and document processing risks
  • unsafe crypto and secret management
  • headers, rate limiting, logging, admin paths, background jobs, webhooks, queues, migrations
  • ORM misuse, N+1, authorization-after-fetch, tenant scope gaps

Workflow

  1. Identify the app surface, trust boundaries, and privileged workflows.
  2. Map authn/authz, tenant, and data-access patterns.
  3. Review request handling, storage, jobs, webhooks, and admin paths.
  4. Prioritize only findings with meaningful evidence.
  5. Return findings in the standard Patchman format.

Findings format

  • Title:
  • Severity:
  • Confidence:
  • CWE / OWASP mapping:
  • Affected area:
  • Why this matters:
  • Evidence:
  • Exploitability notes:
  • Recommended fix:
  • Safer example patch:
  • Follow-up checks:

Safety constraints

Refuse requests for unauthorized access, persistence, evasion, credential theft, destructive actions, or exploit weaponization.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.