security-audit

name	security-audit
description	Use when assessing a feature, service, or full repo for security risk. Maps the threat surface, walks the OWASP Top 10, and emits a finding report with severity counts. Suitable as a release-gate skill.

security-audit

1. Threat surface mapping

List every place untrusted data enters the system: HTTP endpoints, queue consumers, file uploads, env vars read at runtime, third-party webhooks, client-side storage. For each, name the trust boundary it crosses.

2. OWASP Top 10 walk

For each of: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Identification & Auth Failures, Software / Data Integrity Failures, Security Logging & Monitoring Failures, SSRF — record either a finding or "not applicable, because ".

3. Secret hygiene

Grep for committed secrets. Verify .env* is in .gitignore. Check that the CI logs don't echo env vars.

4. Dependency posture

Run the stack's audit tool (pnpm audit, pip-audit, cargo audit, govulncheck, dotnet list package --vulnerable). Note severity counts.

Output format

Findings: critical=N high=N medium=N low=N

[CRITICAL] <title>
  Where:    <file:line or component>
  Vector:   <how an attacker reaches it>
  Impact:   <what they get>
  Mitigation: <smallest viable fix>

Append the OWASP walk as an appendix so reviewers can see what was checked even when there were no findings.