Security and code-quality audit — vulnerability scanning, OWASP categories, secret detection, dependency checks, compliance. Use to check for security issues or scan before a release.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Security and code-quality audit — vulnerability scanning, OWASP categories, secret detection, dependency checks, compliance. Use to check for security issues or scan before a release.
disable-model-invocation
true
Audit Skill
Overview
The audit skill provides comprehensive on-demand security and code quality audits for your codebase. It identifies vulnerabilities, security issues, code smells, outdated dependencies, exposed secrets, and compliance problems across all supported technology stacks.
When to Use:
Security audits and vulnerability scans
Pre-deployment security checks
Compliance verification (GDPR, HIPAA, SOC2)
Code quality assessment
Dependency vulnerability scanning
Secret exposure detection
Third-party license compliance
Technology Coverage:
React/TypeScript/JavaScript projects
Go applications
Rust projects
Python codebases
Full-stack applications
Monorepos and microservices
Audit Categories
1. Security Vulnerabilities (OWASP Top 10)
What Gets Checked:
SQL injection vulnerabilities
Cross-site scripting (XSS)
Authentication and session management flaws
Security misconfigurations
Sensitive data exposure
XML external entities (XXE)
Broken access control
Cross-site request forgery (CSRF)
Using components with known vulnerabilities
Insufficient logging and monitoring
Detection Methods:
Static code analysis
Pattern matching for common vulnerabilities
Framework-specific security checks
API endpoint security validation
Input validation analysis
2. Dependency Vulnerabilities
What Gets Checked:
Outdated packages with known CVEs
Unmaintained dependencies
License compatibility issues
Transitive dependency risks
Version conflicts
Package Managers Supported:
npm/yarn/pnpm (JavaScript/TypeScript)
go.mod (Go)
Cargo.toml (Rust)
requirements.txt/pyproject.toml (Python)
Gemfile (Ruby)
Tools Used:
npm audit / yarn audit / pnpm audit
go mod verify + vulnerability databases
cargo audit
pip-audit / safety
3. Exposed Secrets and Credentials
What Gets Detected:
Hardcoded API keys and tokens
Database credentials
Private keys and certificates
OAuth tokens and secrets
AWS/GCP/Azure credentials
JWT secrets
Encryption keys
Detection Patterns:
Regex patterns for common secret formats
Environment variable misuse
Configuration file analysis
Git history scanning (if requested)
Common secret naming patterns
False Positive Reduction:
Ignore test fixtures and mocks
Respect .gitignore patterns
Check for proper environment variable usage
Validate against .env.example templates
4. Code Quality Issues
What Gets Analyzed:
Code complexity (cyclomatic complexity)
Code duplication
Dead code and unused exports
Large functions and files
Naming convention violations
Magic numbers and hardcoded values
Lack of error handling
Poor separation of concerns
Metrics Calculated:
Cyclomatic complexity per function
Duplication percentage
Lines of code (LOC) per file/function
Comment-to-code ratio
Test-to-code ratio
Running Audits
Full Audit
Run all audit categories:
Please run a full security and quality audit of this codebase
The audit will:
Scan all source files for vulnerabilities
Check dependencies for known CVEs
Search for exposed secrets
Analyze code quality metrics
Generate comprehensive report
Category-Specific Audits
Security Only:
Run a security audit focusing on OWASP top 10 vulnerabilities
Dependencies Only:
Audit all dependencies for vulnerabilities and outdated packages
Secrets Only:
Scan for exposed secrets and credentials
Code Quality Only:
Analyze code quality and identify code smells
Targeted Audits
Specific Directory:
Audit the /src/auth directory for security issues
Specific Files:
Audit UserController.ts and AuthService.ts for vulnerabilities
## Integration with Dev Plugin
### With Code Analysis Agent
Use code-analysis enrichment before audit:
First enrich the codebase with mnemex, then run security audit
This provides:
- Context-aware vulnerability detection
- Better false positive filtering
- Dependency graph analysis
### With Test Architect Agent
Combine audit with test coverage:
Run audit and identify untested critical code paths
### With Optimize Skill
Security-performance trade-offs:
Audit security implications of performance optimizations
## Best Practices
### 1. Regular Audits
**Recommended Schedule**:
- Daily: Dependency vulnerability scans (CI/CD)
- Weekly: Full security audit
- Pre-deployment: Comprehensive audit
- Post-incident: Targeted security review
### 2. Incremental Audits
For large codebases:
Audit files changed in the last 7 days
This focuses on recent changes and reduces noise.
### 3. Baseline and Track
**First Audit**:
Run full audit and establish security baseline
**Subsequent Audits**:
Run audit and compare against baseline
Track improvements over time.
### 4. Prioritize by Risk
Focus on:
1. User-facing authentication code
2. Payment processing
3. Data storage and retrieval
4. API endpoints with PII
5. Third-party integrations
### 5. Automate in CI/CD
**GitHub Actions Example**:
```yaml
- name: Security Audit
run: |
npm audit --audit-level=high
# Run custom audit script
GDPR Compliance Audit
[PASS] Data encryption at rest
[FAIL] Missing data retention policy
[FAIL] No user data export endpoint
[PASS] Consent management implemented
[WARN] Privacy policy link outdated
[PASS] TLS 1.3 enforced
The audit skill provides comprehensive security and quality analysis on-demand. Use it regularly to maintain code health, catch vulnerabilities early, and ensure compliance with industry standards.
Key Takeaways:
Run audits frequently (daily in CI/CD)
Prioritize CRITICAL and HIGH findings
Establish baselines and track progress
Integrate with other dev skills for comprehensive analysis
Automate where possible
For performance analysis, see the optimize skill. For test coverage gaps, see the test-coverage skill.
