メニュー
Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/tranhieutt/software_development_department --skill security-auditコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Turns real agent failures, repeated prompts, team-specific workflows, and durable project lessons into better SDD skills or memory entries. Use when the user asks to create/update/refine skills, extract reusable lessons, improve skill routing, encode team process, or save patterns for future sessions.
Provides the vendored agent-style v0.3.5 prose rule pack as a portable Claude skill. Use when installing, syncing, applying, or auditing SDD Agent-Style support in another project, or when a style-review workflow needs the bundled rules.
Reviews Markdown prose against the pinned agent-style v0.3.5 rules and optionally writes a polished copy beside the source. Use for specs, ADRs, PR bodies, release notes, and technical docs when prose quality or evidence discipline matters.
SOC 職業分類に基づく
SKILL.md を表示中
| name | security-audit |
| type | workflow |
| description | Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening. |
| context | fork |
| agent | security-engineer |
| when_to_use | When performing security audits, vulnerability scanning, penetration testing, or hardening web applications and APIs |
| allowed-tools | Read, Glob, Grep, Bash |
| argument-hint | [target: api|frontend|backend|infra|full] |
| user-invocable | true |
| effort | 5 |
Systematic security review using static analysis tools available in the codebase. Covers OWASP Top 10, secrets exposure, auth patterns, and dependency risk.
Identify entry points — list all routes/controllers:
grep -rn "app\.\(get\|post\|put\|delete\|patch\)\|@app\.route\|router\." src/ --include="*.{js,ts,py}" | head -60
Identify auth middleware — check which routes are protected:
grep -rn "auth\|middleware\|guard\|require_login\|jwt\|bearer" src/ -i --include="*.{js,ts,py}" | head -40
Map external dependencies — check package files for known-risky libs:
cat package.json 2>/dev/null || cat requirements.txt 2>/dev/null || cat go.mod 2>/dev/null
Note findings — list: total endpoints found, unprotected routes, third-party auth libs.
Scan for hardcoded secrets:
grep -rn "password\s*=\s*['\"][^'\"]\|api_key\s*=\s*['\"][^'\"]\|secret\s*=\s*['\"][^'\"]" src/ -i | grep -v ".example" | head -30
Scan for tokens/keys in source:
grep -rEn "(sk-|AIza|AKIA|ghp_|xox[baprs]-)[A-Za-z0-9]+" src/ | head -20
Check .env files are gitignored:
cat .gitignore | grep -i "\.env" ; ls -la .env* 2>/dev/null
Check for secrets in logs:
grep -rn "console\.log.*password\|logger.*token\|print.*secret" src/ -i | head -20
Flag: any hardcoded credential or unignored .env file is a P0 finding.
SQL injection risk — look for string concatenation in queries:
grep -rn "query.*+\|execute.*f\"\|raw.*%s\|SELECT.*\$\{" src/ --include="*.{js,ts,py}" | head -30
Command injection risk — shell execution with user input:
grep -rn "exec(\|spawn(\|subprocess\|os\.system\|child_process" src/ --include="*.{js,ts,py}" | head -20
XSS risk — unescaped HTML rendering:
grep -rn "innerHTML\|dangerouslySetInnerHTML\|v-html\|\.html(" src/ --include="*.{js,ts,jsx,tsx,vue}" | head -20
Check for input validation middleware — is there a schema validator at boundaries?
grep -rn "joi\|zod\|yup\|pydantic\|cerberus\|marshmallow" src/ --include="*.{js,ts,py}" | head -10
JWT / token handling — check for weak configs:
grep -rn "algorithm.*HS256\|expiresIn\|verify\|decode" src/ --include="*.{js,ts,py}" | head -20
Password hashing — confirm bcrypt/argon2, not MD5/SHA1:
grep -rn "md5\|sha1\|hashSync\|bcrypt\|argon2\|pbkdf2" src/ -i --include="*.{js,ts,py}" | head -20
CORS config — check for wildcard origins:
grep -rn "cors\|Access-Control-Allow-Origin\|\*" src/ --include="*.{js,ts,py}" | head -20
Authorization checks — look for missing ownership checks in update/delete:
grep -rn "findById\|findOne\|get_object_or_404" src/ --include="*.{js,ts,py}" | head -20
Review each — does the handler verify resource.userId === req.user.id?
HTTP security headers — check if helmet/similar is configured:
grep -rn "helmet\|Content-Security-Policy\|X-Frame-Options\|Strict-Transport" src/ --include="*.{js,ts}" | head -10
Rate limiting — check for brute-force protection on auth routes:
grep -rn "rateLimit\|throttle\|rate_limit\|slowDown" src/ --include="*.{js,ts,py}" | head -10
HTTPS enforcement — check redirect config:
grep -rn "http://\|forceHttps\|redirectToHttps\|SECURE_SSL_REDIRECT" src/ --include="*.{js,ts,py}" | head -10
For each finding, record:
| Severity | Category | File:Line | Description | Remediation |
|---|---|---|---|---|
| P0 Critical | ||||
| P1 High | ||||
| P2 Medium | ||||
| P3 Low / Info |
Severity guide:
Save report to docs/technical/security-audit-{YYYY-MM-DD}.md.
api / frontend / backend / infra / full)docs/technical/security-audit-[YYYY-MM-DD].md?"Deliver exactly:
docs/technical/security-audit-{YYYY-MM-DD}.mdCLEAN / LOW RISK / MEDIUM RISK / HIGH RISK — DO NOT DEPLOYcode-review — line-by-line review with security lensguard — freeze check before deploying a fix