Menu
Performs a first-pass security audit of project structure and attack surface to map risk and entry points. Use as the starting point for a security review.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | initial-security-analysis |
| description | Performs a first-pass security audit of project structure and attack surface to map risk and entry points. Use as the starting point for a security review. |
| license | CC0-1.0 |
| metadata | {"category":"security"} |
| allowed-tools | Read Grep Glob Write |
| disable-model-invocation | true |
| argument-hint | [path or scope] |
Target: $ARGUMENTS
If no target path is given above, review the entire codebase.
Perform a Project Structure Audit
Analyze the entire project structure and identify:
Start by detecting the tech stack (language, framework, package manager), then examine the core files appropriate for that stack:
package.json, app.js/server.js, routes/, middleware/requirements.txt/pyproject.toml, settings.py/app.py, URL config, middleware configpom.xml/build.gradle, application.properties, controller and filter/interceptor classesGemfile, config/routes.rb, app/controllers/, config/initializers/go.mod, main.go, router registration filescomposer.json, routes/, app/Http/Middleware/, bootstrap/app.phpFor other stacks, locate the equivalent dependency manifest, entry point, routing layer, and middleware chain.
A structured finding report with the following for each issue:
Title, Severity (Critical/High/Medium/Low), CWE (if applicable), Evidence (file, function, line ranges), and a short Why it matters.
Exploitability notes and, where safe, a minimal PoC or reproduction steps (no real secrets).
Remediation: precise code-level fix or config change (snippets welcome), plus defense-in-depth guidance.
A summary risk score (0–10) and top 3–5 prioritized fixes that reduce risk fastest.
A checklist diff: which items from the “Check for” list are Pass/Fail/Not Applicable.
Be concrete and cite exact code locations and identifiers.
Prefer minimal, drop-in fix snippets over prose.
Do not invent files or functions that aren’t present; if context is missing, mark as Unable to verify and say what code would prove it.
Write this into a markdown file and place it in the audits/ folder.
Reviews API and infrastructure security configuration, including endpoints, headers, transport, and deployment settings. Use when auditing API or infrastructure hardening.
Conducts a comprehensive authentication security review covering login, sessions, tokens, and credential handling. Use when auditing authentication for vulnerabilities.
Analyzes authorization and access-control logic across routes and resources for privilege and enforcement flaws. Use when auditing authorization, RBAC, or access control.
Analyzes business logic for security flaws such as workflow bypasses, race conditions, and abuse cases. Use when reviewing application logic for exploitable behavior.
Detects duplicated and near-duplicate code across the codebase and suggests consolidation. Use when reviewing for copy-paste code, repeated logic, or DRY violations.
Analyzes code complexity and adherence to quality standards, flagging overly complex functions and metric outliers. Use when auditing maintainability, cyclomatic complexity, or coding-standard compliance.