Menu
Comprehensive security audit with OWASP Top 10 analysis. Use when: "security", "vulnerability", "audit", "pentest", "check secrets", "is it secure", "owasp", "security scan"
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Full codebase audit: architecture health, dependencies, complexity, tech debt. Use when: "audit", "health check", "codebase analysis", "tech debt", "architecture review", "dependency check", "code quality"
Structured brainstorming with multiple approaches and tradeoffs. Use when: "brainstorm", "explore options", "what are my options", "compare approaches", "pros and cons", "which is better", "how should I", "alternatives"
Build error diagnosis and resolution. Use when: "build failed", "compile error", "bundler error", "fix build", "npm error", "type error", "won't compile"
Scaffold a new application with interactive dialogue. Use when: "create", "build me", "make an app", "new project", "scaffold", "generate app", "start new"
Generate a new custom skill from natural language description. Use when: "create skill", "new skill", "make a skill", "add command", "custom workflow", "skill template", "generate skill"
Systematic debugging with hypothesis-driven investigation. Use when: "debug", "not working", "bug", "broken", "error", "unexpected behavior", "fix issue", "investigate"
| name | security |
| description | Comprehensive security audit with OWASP Top 10 analysis. Use when: "security", "vulnerability", "audit", "pentest", "check secrets", "is it secure", "owasp", "security scan" |
| argument-hint | [quick|auth|deps|owasp] |
| user-invocable | true |
| disable-model-invocation | true |
$ARGUMENTS
This command performs a comprehensive security audit on the project using security-auditor and penetration-tester agents.
/security - Full security audit
/security quick - Quick scan (secrets + dependencies only)
/security auth - Authentication/authorization review
/security deps - Dependency vulnerability scan
/security owasp - OWASP Top 10 checklist review
When /security is triggered:
Automated scans
# Run security scan script
python .agent/skills/vulnerability-scanner/scripts/security_scan.py .
# Run dependency analysis
python .agent/skills/vulnerability-scanner/scripts/dependency_analyzer.py .
# Check for secrets in code
# (included in security_scan.py)
Agent analysis
security-auditor agent for code reviewpenetration-tester agent for attack surface analysisOWASP Top 10:2025 checklist
| # | Category | Check |
|---|---|---|
| A01 | Broken Access Control | IDOR, auth bypass, SSRF |
| A02 | Security Misconfiguration | Headers, CORS, defaults |
| A03 | Supply Chain | Dependencies, lock files |
| A04 | Cryptographic Failures | Weak crypto, exposed secrets |
| A05 | Injection | SQL, XSS, command injection |
| A06 | Insecure Design | Architecture flaws |
| A07 | Auth Failures | Session, MFA, credentials |
| A08 | Integrity Failures | Unsigned updates |
| A09 | Logging Failures | Missing audit trails |
| A10 | Exceptional Conditions | Error handling, fail-open |
Generate report
## Security Audit Report
### Scan Results
- Security Scan: PASS/FAIL
- Dependency Audit: X vulnerabilities (Y critical)
- Secrets Check: PASS/FAIL
### Findings by OWASP Category
#### A01: Broken Access Control
- [Finding or "No issues found"]
#### A05: Injection
- [Finding or "No issues found"]
[... all categories ...]
### Risk Summary
| Severity | Count | Action |
|----------|-------|--------|
| Critical | X | Fix immediately |
| High | X | Fix before deploy |
| Medium | X | Schedule fix |
| Low | X | Document |
### Recommendations
1. [Priority fix with details]
2. [Secondary fix]
### Next Steps
- [ ] Fix critical findings
- [ ] Re-run `/security quick` to verify
- [ ] Schedule medium/low fixes
/security
/security quick
/security auth
/security deps
/security owasp