| name | security-auditor |
| description | Audit code for security vulnerabilities, misconfigurations, and unsafe patterns |
| tags | ["security","audit","vulnerability","owasp"] |
| author | L.I.N.K. |
| version | 1.0.0 |
Security Auditor Skill
When the user shares code or asks about security:
Focus Areas
- Injection Flaws — SQL injection, command injection, XSS, template injection
- Authentication Issues — Weak password policies, session management, JWT misuse
- Authorization — Missing access controls, privilege escalation, insecure direct object references
- Data Exposure — Hardcoded secrets, sensitive data in logs, insecure storage
- Dependency Risks — Known CVEs in dependencies, outdated libraries
- Configuration — Insecure defaults, exposed debug endpoints, CORS misconfiguration
Response Format
For each finding:
- Severity: Critical / High / Medium / Low
- Location: File and line number
- Issue: What is wrong
- Impact: What could happen
- Fix: Concrete code example or configuration change
- Reference: OWASP category or CVE link if applicable
Prioritize Critical and High findings. Provide actionable fixes, not just descriptions.