Security auditor

Skill willianbs/skills/security-auditor

Threat-aware security assessment of code and trust boundaries with evidence-based findings. Use for auth, PII, payments, integrations, or when review escalates. Emits SECURITY_REPORT. Never invents vulns, never prints live secrets, and never claims exploitability without a proof sketch for High+.From its SKILL.md

Install

npx -y skills add willianbs/skills --skill security-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

23 days oldThe repository was created 23 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.4 KB, 699 tokens by cl100k_base, as published. Nobody here has run it

Purpose

Find real security risk before production. Prioritize by Likelihood × Impact with evidence.

When to Use / When NOT to Use

Use when: authz/authn, PII, payments, file uploads, SSRF-prone integrations, dependency/supply-chain concerns, HighRisk specs, quality-gate missing security evidence.

Do not use when: pure UI copy; style review; user wants a full pen-test simulation without codebase access.

Preconditions

Code/architecture context available. Prefer CONTEXT_PACK + diff/IMPL_REPORT.

Inputs / Outputs

Inputs: change set or system scope, CONTEXT_PACK, data classification if known.

Outputs: SECURITY_REPORT (authoritative for quality-gate security section).

Upstream / Downstream

Upstream: threat-modeler (preferred for HighRisk), code-reviewer, feature-implementer, engineering-os, quality-gate.

Downstream: feature-implementer (remediation), quality-gate, adr-enforcer (security architecture).

Core Principles

Assets and trust boundaries before checklists.
Least privilege, validate inputs, fail closed.
Likelihood × Impact; reachability matters.
High+ needs a proof sketch (data flow / exploit path).
Redact secrets; report leaks without echoing values.
Business-logic abuse cases count.
Do not implement fixes unless asked.

Process

Assets — data, sessions, keys, admin actions, money movement.
Trust boundaries — client/server, services, tenants, admin vs user.
Abuse cases — spoofing, tampering, repudiation, info disclosure, DoS, elevation (STRIDE-light).
Review surfaces — authn/authz, injection, SSRF, XSS, CSRF, deserialization, uploads, secrets, deps, insecure defaults.
Supply chain — new deps, install scripts, lockfile drift (note; don’t invent CVEs).
Findings — severity, confidence, evidence, remediation, release impact.
False-positive control — mark Low confidence when unreachability likely.

Evidence Requirements

High/Critical: data-flow or concrete code path. Never paste secret values—only locations.

Stop Conditions / Failure Modes

Condition	Action
Critical exploitable issue	`Block` release
Insufficient context for HighRisk area	`ProceedWithConditions` or Block until context loaded
Suspected secret in repo	Critical finding + redact

Severity + Confidence

Critical = authz bypass, RCE, mass data leak, auth break with proven/high-confidence path.

Output Contract

## SECURITY_REPORT
Assets & boundaries: ...
Findings:
  - Severity, Confidence, evidence, remediation
Release impact: Proceed | ProceedWithConditions | Block
Decision: ...

Handoffs

quality-gate — consume as authoritative security section
feature-implementer — remediations
adr-enforcer — security architecture decisions

Never

Never invent CVEs or vulns for drama.
Never print tokens/passwords/keys.
Never equate “uses crypto” with “secure.”
Never skip authz negative cases on access-control changes.

What ships with it: 1 file

714 B alongside SKILL.md

README.md714 B