audit

On-demand security and code quality audit. Use when checking for vulnerabilities, security issues, code smells, or compliance problems. Trigger keywords - "audit", "security check", "vulnerability scan", "code quality", "compliance", "security audit".

Ir a la instalación

Repositorio: MadAppGang/claude-code
Última actividad en el origen: 28 de enero de 2026 a las 12:28
Idioma detectado de SKILL.md: inglés
Estrellas: 278
Forks: 29

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/MadAppGang/claude-code --skill audit

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

Please run a full security and quality audit of this codebase

Run a security audit focusing on OWASP top 10 vulnerabilities

Audit all dependencies for vulnerabilities and outdated packages

Scan for exposed secrets and credentials

Analyze code quality and identify code smells

Audit the /src/auth directory for security issues

Audit UserController.ts and AuthService.ts for vulnerabilities

Run pre-deployment audit checklist

# Security and Quality Audit Report

**Generated**: 2026-01-28 14:32:00
**Scope**: Full codebase audit
**Files Scanned**: 247
**Duration**: 8.3 seconds

## Executive Summary

- CRITICAL: 2 findings
- HIGH: 5 findings
- MEDIUM: 12 findings
- LOW: 23 findings
- INFO: 8 findings

**Risk Score**: 7.2/10 (HIGH)

## Critical Findings

### [CRITICAL-001] SQL Injection Vulnerability
**File**: src/database/queries.ts:42
**Severity**: CRITICAL
**Category**: Security - SQL Injection

**Issue**: User input concatenated directly into SQL query without sanitization.

**Code**:
```typescript
const query = `SELECT * FROM users WHERE email = '${email}'`;

const query = db.prepare('SELECT * FROM users WHERE email = ?').bind(email);

const STRIPE_SECRET_KEY = "sk_live_abc123xyz789";

const STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY;

npm install lodash@latest


## Integration with Dev Plugin

### With Code Analysis Agent

Use code-analysis enrichment before audit:


This provides:
- Context-aware vulnerability detection
- Better false positive filtering
- Dependency graph analysis

### With Test Architect Agent

Combine audit with test coverage:


### With Optimize Skill

Security-performance trade-offs:


## Best Practices

### 1. Regular Audits

**Recommended Schedule**:
- Daily: Dependency vulnerability scans (CI/CD)
- Weekly: Full security audit
- Pre-deployment: Comprehensive audit
- Post-incident: Targeted security review

### 2. Incremental Audits

For large codebases:


This focuses on recent changes and reduces noise.

### 3. Baseline and Track

**First Audit**:


**Subsequent Audits**:


Track improvements over time.

### 4. Prioritize by Risk

Focus on:
1. User-facing authentication code
2. Payment processing
3. Data storage and retrieval
4. API endpoints with PII
5. Third-party integrations

### 5. Automate in CI/CD

**GitHub Actions Example**:
```yaml
- name: Security Audit
  run: |
    npm audit --audit-level=high
    # Run custom audit script

#!/bin/bash
# Scan staged files for secrets
git diff --cached --name-only | xargs grep -E "(api_key|secret|password)"

We're deploying to production tomorrow. Run a comprehensive security audit.

Check all npm dependencies for known vulnerabilities

Found 3 vulnerabilities (1 high, 2 moderate)

HIGH: axios@0.21.1 (CVE-2021-3749)
- Fix available: axios@0.21.4
- Breaking: No
- Run: npm install axios@0.21.4

MODERATE: glob-parent@5.1.1 (CVE-2020-28469)
- Fix available: glob-parent@6.0.2
- Breaking: Yes (ESM only)
- Review: Migration guide needed

Audit for GDPR compliance issues

GDPR Compliance Audit

[PASS] Data encryption at rest
[FAIL] Missing data retention policy
[FAIL] No user data export endpoint
[PASS] Consent management implemented
[WARN] Privacy policy link outdated
[PASS] TLS 1.3 enforced

Identify code quality issues and technical debt

1. UserService.ts - Complexity 28 (threshold: 15)
   Recommendation: Extract validation logic

2. utils/helpers.ts - 234 lines duplicated in 3 files
   Recommendation: Create shared utility module

3. api/routes.ts - 847 lines (threshold: 500)
   Recommendation: Split into feature-based modules

[Developer] → Request audit
    ↓
[Audit Skill] → Scan codebase
    ↓
[Generate Report] → Categorize findings
    ↓
[Prioritize] → CRITICAL → HIGH → MEDIUM → LOW
    ↓
[Fix Critical] → Apply fixes
    ↓
[Re-audit] → Verify fixes
    ↓
[Update Baseline] → Track progress

name	audit
description	On-demand security and code quality audit. Use when checking for vulnerabilities, security issues, code smells, or compliance problems. Trigger keywords - "audit", "security check", "vulnerability scan", "code quality", "compliance", "security audit".
version	0.1.0
tags	["dev","audit","security","quality","compliance"]
keywords	["audit","security","vulnerability","code-quality","compliance","scan","check"]
plugin	dev
updated	"2026-01-28T00:00:00.000Z"

name	audit
description	On-demand security and code quality audit. Use when checking for vulnerabilities, security issues, code smells, or compliance problems. Trigger keywords - "audit", "security check", "vulnerability scan", "code quality", "compliance", "security audit".
version	0.1.0
tags	["dev","audit","security","quality","compliance"]
keywords	["audit","security","vulnerability","code-quality","compliance","scan","check"]
plugin	dev
updated	"2026-01-28T00:00:00.000Z"

audit

Opciones de instalación

Revisa los archivos de origen

Audit Skill

Overview

Audit Skill

Overview

Audit Categories

1. Security Vulnerabilities (OWASP Top 10)

2. Dependency Vulnerabilities

3. Exposed Secrets and Credentials

4. Code Quality Issues

Running Audits

Full Audit

Category-Specific Audits

Targeted Audits

Audit Report Format

Severity Levels

Report Structure

[CRITICAL-002] Exposed API Key

High Priority Findings

[HIGH-001] Outdated Dependency with Known CVE

Compliance Checks

OWASP Top 10 Coverage

Recommendations

Examples

Example 1: Pre-Deployment Security Audit

Example 2: Dependency Vulnerability Scan

Example 3: Compliance Check (GDPR)

Example 4: Code Quality Audit

Stack-Specific Audit Patterns

React/TypeScript

Go

Rust

Audit Workflow Integration

Conclusion

audit

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

Audit Skill

Overview

Audit Skill

Overview

Audit Categories

1. Security Vulnerabilities (OWASP Top 10)

2. Dependency Vulnerabilities

3. Exposed Secrets and Credentials

4. Code Quality Issues

Running Audits

Full Audit

Category-Specific Audits

Targeted Audits

Audit Report Format

Severity Levels

Report Structure

[CRITICAL-002] Exposed API Key

High Priority Findings

[HIGH-001] Outdated Dependency with Known CVE

Compliance Checks

OWASP Top 10 Coverage

Recommendations

Examples

Example 1: Pre-Deployment Security Audit

Example 2: Dependency Vulnerability Scan

Example 3: Compliance Check (GDPR)

Example 4: Code Quality Audit

Stack-Specific Audit Patterns

React/TypeScript

Go

Rust

Audit Workflow Integration

Conclusion