Menu
Procedural knowledge for conducting focused security reviews and enforcing secure coding practices.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Procedural knowledge for generating and maintaining code documentation, API specs, and architecture diagrams.
Procedural knowledge for orchestrating multi-agent systems and Agent-to-Agent (A2A) handoffs.
Procedural knowledge for designing autonomous AI agents with tools, memory, and reasoning loops.
Procedural knowledge for implementing the Model Context Protocol (MCP) to expose local tools to LLMs.
Procedural knowledge for ensuring frontend interfaces comply with WCAG standards.
Procedural knowledge for designing and configuring continuous integration and deployment pipelines.
| name | security-audit |
| description | Procedural knowledge for conducting focused security reviews and enforcing secure coding practices. |
Procedural knowledge for conducting focused security reviews and enforcing secure coding practices.
Enable the QA Engineer and Developer roles to proactively identify and mitigate security vulnerabilities (e.g., OWASP Top 10) before code reaches production.
.ace/standards/security.mdStep 1: Input Validation
- Verify all user input is sanitized and validated against an allowlist.
- Check for SQL Injection (enforce parameterized queries/ORMs).
- Check for XSS (enforce context-aware output encoding).
Step 2: Authentication & Authorization
- Verify endpoints have appropriate permission checks.
- Ensure JWTs/tokens are securely stored (e.g., HttpOnly cookies) and validated.
- Check for Insecure Direct Object References (IDOR).
Step 3: Secret Management
- Scan for hardcoded API keys, passwords, or tokens.
- Ensure `.env` files are not tracked in Git.
Step 1: Dependencies
- Review `package.json`, `requirements.txt`, etc., for known vulnerable packages.
- Ensure lock files are committed and audited.
Step 2: Security Headers
- Ensure appropriate headers are set (CORS, CSP, HSTS, X-Frame-Options).
"Apply the security-audit skill from .ace/skills/security-audit/SKILL.md
to review this pull request for vulnerabilities."