agentsclimarketplace

Security audit

Skill nuwansamaranayake/AiGNITEClaudeAssets/security-audit

Nine Claude Code skills that turn one developer into a mobile app studio. Built for AiGNITE Consulting's MCP-first product portfolio.

Install
npx -y skills add nuwansamaranayake/AiGNITEClaudeAssets --skill security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Runs the three-pass AiGNITE security audit on any mobile or backend project before deployment. Identifies vulnerabilities, applies fixes, and re-audits to catch regressions introduced by the fixes. Produces a tier-classified SECURITY_AUDIT.md with CWE references. Use this skill whenever the user mentions a security audit, pre-deploy check, asking whether code is safe to ship, vulnerability check, security review, or auditing an app, even if they do not name the skill by name.

SKILL.md

3.6 KB, as published. Nobody here has run it

security-audit

Purpose

Find the security gaps that block a clean TestFlight or Play Store submission. Fix the Critical and High issues. Confirm the fixes did not introduce new gaps. Hand back a signed audit document.

When to trigger

Trigger on these user phrases. Match loosely.

  • "security audit"
  • "pre-deploy check"
  • "is this safe to ship"
  • "check for vulnerabilities"
  • "security review"
  • "audit my app"
  • "OWASP check"
  • "ready for App Store"

Behavior: three passes

Pass 1: identify

Scan the entire project. Produce findings tagged Critical, High, Medium, Low with CWE references. Write to SECURITY_AUDIT.md.

Checks the skill runs:

  • Hard-coded secrets in source (CWE-798)
  • Exposed environment variables in client bundles (CWE-200)
  • Missing server-side validation on API routes (CWE-20)
  • Default-open database policies (CWE-732)
  • Missing or inconsistent auth middleware (CWE-287)
  • Hallucinated package imports (CWE-829)
  • Console logs leaking request bodies or tokens (CWE-532)
  • Missing rate limiting on expensive operations (CWE-770)
  • CORS misconfigurations (CWE-942)
  • SQL injection patterns in raw queries (CWE-89)
  • XSS in user-supplied content paths (CWE-79)
  • Insecure deep linking handlers (CWE-925)
  • Hard-coded API URLs pointing at staging (CWE-1188)

Pass 2: fix

Implement fixes for every Critical and High finding. Apply Medium and Low fixes if the user opts in. After each fix, update SECURITY_AUDIT.md with the resolution and the diff link.

Pass 3: re-audit

Run the full scan again from a fresh context. Compare to pass 1. Flag any new finding introduced by a pass-2 fix. The most common new findings: a fix that broadens an auth check, a fix that adds a console log, a fix that imports a new package without validating it.

If pass 3 surfaces new findings, fix them, run a fourth pass. Stop when a pass introduces zero new Critical or High findings.

Output: SECURITY_AUDIT.md

The skill writes SECURITY_AUDIT.md at the project root using the template in assets/templates/SECURITY_AUDIT.md.template. The document includes:

  • Project name and audit date
  • Pass-1 findings table
  • Pass-2 resolution log
  • Pass-3 regression check
  • Final tier counts
  • Sign-off block

The audit fails (returns non-zero) until every Critical and High finding has a resolution.

Refusals

Refuse to mark an audit complete if:

  • Any Critical finding remains unresolved.
  • Any High finding remains unresolved without explicit user override.
  • Pass 3 surfaced a Critical or High introduced by a pass-2 fix.

Composes with

  • Runs after supabase-bootstrap to verify the schema and policies.
  • Runs before app-store-submission. The submission skill refuses if no recent audit exists.
  • The mcp-to-mobile skill invokes this skill in step 9.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.