| name | asc-audit |
| description | Security and architecture audit. Deeper than review, focused on finding vulnerabilities and structural anti-patterns.
|
Audit Skill
Security and architecture audit. Deeper than review, focused on finding vulnerabilities and structural anti-patterns.
Grounded in: OWASP Top 10 (2021), OWASP ASVS v4, CVSS vulnerability report structure, CWE classification.
Audit Scope
- Trust boundaries: Every point where external input enters the system. Validate that inputs are sanitized, normalized, and rejected when invalid.
- Authentication and authorization: Verify auth checks exist on every endpoint. Check for resource-level authorization, not just identity.
- Data handling: Secrets in code or logs, PII exposure, unsafe deserialization, SQL injection, command injection.
- Architecture boundaries: Business logic in transport layer, shared databases between services, circular dependencies, internal model leakage through public APIs.
- Dependency health: Known vulnerabilities, unmaintained packages, excessive dependency surface.
- Error exposure: Stack traces, internal paths, or implementation details exposed to clients.
For Every Finding
Severity: critical | high | medium | low
Class: vulnerability class (e.g., SQL Injection, Broken Access Control)
Location: file:line
Impact: who or what is affected
Evidence: exact code, behavior, or command output
Remediation: specific fix direction
Validation: how to prove it is fixed
Output
Findings ordered by severity. If no findings, state that explicitly and describe audit coverage.
