Security Audit Skill
Purpose
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.
When to Trigger
- authentication implementation
- authorization logic
- payment processing
- user data handling
- API endpoint creation
- file upload handling
- database queries
- external API integration
When to Skip
- read-only operations on public data
- internal development tooling
- static documentation
- styling changes
Commands
Full Security Scan
Run comprehensive security analysis on the codebase
Example:
Input Validation Check
Check for input validation issues
Example:
Path Traversal Check
Check for path traversal vulnerabilities
SQL Injection Check
Check for SQL injection vulnerabilities
XSS Check
Check for cross-site scripting vulnerabilities
CVE Scan
Scan dependencies for known CVEs
Example:
Security Audit Report
Generate full security audit report
Example:
Threat Modeling
Run threat modeling analysis
Validate Secrets
Check for hardcoded secrets
Scripts
References
Best Practices
- Check memory for existing patterns before starting
- Use hierarchical topology for coordination
- Store successful patterns after completion
- Document any new learnings
