Menu
Audit sécurité OWASP applicatif (secrets, injection, auth, IDOR, dépendances). Findings uniquement, pas d'autofix. Opus, invocation explicite.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Expert guidance for the App Intents framework on Apple platforms. Use when developers mention: (1) Siri or Shortcuts integration, (2) AppIntent, AppEntity, AppEnum, or AppShortcutsProvider, (3) Spotlight actions or indexed entities, (4) exposing app features to Apple Intelligence, (5) parameters, parameter summaries, or intent donation, (6) widget/control configuration intents. Not for widget timeline design itself (see widgetkit-live-activities skill).
Expert guidance for CloudKit sync on Apple platforms. Use when developers mention: (1) iCloud sync or cross-device sync of app data, (2) SwiftData + CloudKit or NSPersistentCloudKitContainer, (3) CKSyncEngine or custom CloudKit record sync, (4) CloudKit sharing / collaboration (CKShare), (5) CloudKit entitlements, containers, or schema deployment, (6) conflict resolution or offline-first with iCloud. Not for third-party sync backends (Firebase, Supabase) and not for app-server REST sync (see docs/api/sync.md).
Expert guidance for StoreKit 2 in-app purchases and subscriptions on Apple platforms. Use when developers mention: (1) in-app purchases, IAP, or subscriptions, (2) Product, Transaction, or currentEntitlements, (3) receipt validation or transaction verification, (4) SubscriptionStoreView / StoreView / ProductView, (5) restore purchases, offer codes, promotional offers, refunds, (6) StoreKit Testing in Xcode or sandbox testing. Not for RevenueCat or third-party billing SDKs.
Apple Human Interface Guidelines for visionOS (Apple Vision Pro). Use when designing or building spatial apps: (1) windows, volumes, and immersive spaces, (2) ornaments, glass material, and spatial layout, (3) eye/hand input, hover effects, and target sizes, (4) comfort, motion, and immersion levels, (5) porting an iOS/iPadOS app to visionOS, (6) RealityKit + SwiftUI scene composition. Companion to the ehmo *-design-guidelines skills for the other Apple platforms.
Expert guidance for WidgetKit widgets and ActivityKit Live Activities on Apple platforms. Use when developers mention: (1) home screen / lock screen / StandBy widgets, (2) Live Activities or Dynamic Island, (3) widget timelines, TimelineProvider, or reload budgets, (4) interactive widgets with App Intents buttons/toggles, (5) Control Center controls (ControlWidget), (6) updating a Live Activity via APNs push. Not for Siri/Shortcuts intents themselves (see app-intents skill).
Audit the health of your Claude Code configuration across all six layers — permissions, hooks, MCP servers, installed skills, agents, settings conflicts. Use when asked to "/health", "check my Claude Code config", "audit my setup", or before debugging unexpected behavior (silent permission denials, MCP tool not appearing, hooks not firing).
| name | security-audit |
| description | Audit sécurité OWASP applicatif (secrets, injection, auth, IDOR, dépendances). Findings uniquement, pas d'autofix. Opus, invocation explicite. |
| version | 1.0.0 |
| platforms | ["linux","macos"] |
| metadata | {"hermes":{"tags":["security","owasp","secrets","injection","auth","audit"],"related_skills":["github","verify-conformance","code-audit"],"model":"deepseek-v4-full"}} |
Adaptation de ed209 (52) — ULK → Hermes. Carte :
docs/backlog/2026-06-28-SPEC-HERMES-SECURITY-AUDIT/CARD.md(P2, GitHub #265).
Audit sécurité OWASP Top 10 + secrets exposés + auth + dépendances vulnérables. Skill la plus coûteuse : scope restreint par défaut (PR diff / fichiers désignés), invocation explicite, politique no-autofix.
<vault>/logs/security-audit/ horodaté + SHA du commit audité (idempotent sur SHA).github) + profondeur (quick / full).fichier:ligne · recommandation.fichier:ligne.security_events : vérifier le token, sinon fallback lockfile.