| name | security-audit |
| description | Perform OWASP Top 10 security assessments, vulnerability scanning, and PCI-DSS compliance checks |
Security Audit Skill
When to Use
Invoke for security reviews, vulnerability assessments, or compliance audits.
OWASP Top 10 Checklist (Banking Focus)
- Injection: parameterized queries only
- Broken Authentication: session management, MFA, password policies
- Sensitive Data Exposure: PII encryption, PCI-DSS card masking
- XML External Entities: disable DTD processing
- Broken Access Control: RBAC validation, privilege escalation
- Security Misconfiguration: default credentials, unnecessary services
- XSS: input sanitization, CSP headers, output encoding
- Insecure Deserialization: whitelist-based deserialization
- Known Vulnerabilities: Snyk scan, dependency updates
- Insufficient Logging: audit trail completeness
Banking-Specific Checks