security-auditor

name	security-auditor
description	Security audit workflow for AI-generated application code, APIs, infrastructure changes, dependencies, secrets, auth flows, and pull requests before they ship.
zh_description	用于安全、审计，支持安全扫描、审计、加固和风险治理。
version	1.0.0
author	seaworld008
source	in-house
source_url
license	MIT
tags	[security, appsec, ai-generated-code, code-review, owasp, secrets, dependency-audit, threat-modeling]
created_at	2026-06-03
updated_at	2026-06-03
quality	4
complexity	advanced

Security Auditor

Use this skill to audit AI-generated code and human-written changes before they are merged or deployed. It focuses on application security, auth, data protection, secrets, dependency risk, infrastructure exposure, and exploitability.

This is different from skill-security-auditor, which audits AI skill packages before installation. Use security-auditor for product code and repository changes.

When to Use

• Reviewing AI-generated code for security flaws.
• Auditing pull requests that touch authentication, authorization, payments, user data, file upload, webhooks, secrets, infrastructure, or dependencies.
• Checking generated APIs, database queries, server actions, middleware, background jobs, or CI workflows.
• Validating that frontend changes do not expose privileged data or trust client-only checks.
• Investigating a suspected vulnerability or insecure pattern.
• Hardening code before release.
• Creating security regression tests for a fixed issue.

Skip When

• The target is an AI skill package rather than application code. Use skill-security-auditor.
• The user requests a full formal penetration test, legal compliance certification, or production exploit attempt without authorization.
• The task is pure style review with no security relevance.

Core Capabilities

1. Threat-model a change by assets, actors, trust boundaries, and abuse paths.
2. Review code for OWASP-style issues and framework-specific security mistakes.
3. Check authn/authz correctness beyond happy-path role checks.
4. Detect secret leakage, unsafe logging, and sensitive data exposure.
5. Review dependency and supply-chain risk.
6. Inspect infrastructure and CI changes for privilege escalation or exposure.
7. Produce actionable findings with severity, evidence, exploit path, and fix.
8. Recommend tests that prevent recurrence.

Audit Sequence

Use this sequence for repository changes:

1. Identify changed files and security-sensitive surfaces.
2. Map trust boundaries and protected assets.
3. Review input validation, auth, data access, side effects, and error paths.
4. Scan for secrets and dangerous APIs.
5. Check dependencies, CI, and infrastructure exposure.
6. Confirm mitigations with tests or concrete reasoning.
7. Report only actionable findings with severity and evidence.

Threat Model Mini-Template

## Assets
 User data:
 Credentials/tokens:
 Money or quota:
 Admin capabilities:


 Anonymous:
 Authenticated user:
 Tenant member:
 Admin:
 External service:


 Browser to API:
 API to database:
 Webhook provider to app:
 CI to cloud:


 ...