| name | security-audit |
| description | Scan code for security vulnerabilities — OWASP Top 10, credential leaks, injection attacks, path traversal, and insecure configurations. Trigger on /security-audit, or when reviewing code for security issues. |
| user-invocable | true |
| allowed-tools | Read, Grep, Glob, Bash |
Security Audit
Review code for security vulnerabilities. Read-only — do not fix without explicit approval.
Audit Checklist
1. Injection attacks
- Command injection — user input passed to shell commands (
exec, spawn, eval, $())?
- SQL injection — raw query construction instead of parameterized queries?
- Path traversal — user input used in file paths without sanitization?
- XSS — user input rendered in HTML without escaping?
2. Secrets and credentials
- Hardcoded API keys, tokens, passwords, or connection strings?
.env files committed to git?- Secrets in logs, error messages, or test output?
- AWS/cloud credentials in code?
3. Authentication and authorization
- Missing auth checks on protected endpoints?
- Weak password policies or storage?
- Session management issues (fixed tokens, no expiry)?
- Insecure direct object references (IDOR)?
4. Data validation
- Missing input validation on user-supplied data?
- Insufficient output encoding?
- Unsafe deserialization?
- Trusting client-side data (price, role, permissions)?
5. Configuration
- Debug/development mode enabled in production?
- Exposed internal endpoints?
- Insecure CORS configuration?
- Missing security headers?
6. Dependencies
- Known vulnerable packages?
- Outdated dependencies with known CVEs?
- Unnecessary dependencies increasing attack surface?
Reporting
Order by severity: critical → high → medium → low.
## Findings
### Critical
- ...
### High
- ...
### Medium
- ...
### Low / Info
- ...
Rules
- Read-only — do not fix vulnerabilities unless explicitly asked.
- Do not run security tools that modify files or configurations.
- Report findings with specific file:line references.
- If unsure about a finding, flag it as "needs verification."
- Never disclose findings outside the project.
Experience Log
This skill learns from experience. Mechanism:
- Read
.claude/experience/security-audit.md at skill start to benefit from past lessons.
- Write to
.claude/experience/security-audit.md after use if you learned something new.
- Format:
YYYY-MM-DD: <lesson> — one line per entry.
- Evolve: If the same issue repeats 3+ times, update this SKILL.md itself.
