# Security Audit

> @'

- Skill: `alimansoor2003/security-audit-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add alimansoor2003/security-audit-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/alimansoor2003/security-audit-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: alimansoor2003 (https://skillmd.com/u/alimansoor2003)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/alimansoor2003/security-audit-2

---

@'
---
name: security-audit
description: Audits codebases for security vulnerabilities, secrets exposure, auth risks, dependency health, and misconfigurations.
version: 1.0.0
author: software-engineering
tags: [security, audit, devsecops, claude-code]
---

# Security Audit Skill

Execute a comprehensive, end-to-end security audit on the current codebase. Inspect source code, configurations, dependencies, and environment files to identify and remediate security vulnerabilities across 19 critical checkpoints.

---

## 🎯 Scope & Objectives

When invoked (`/security-audit` or when asked to perform a security check), analyze the repository against the following 6 domain modules:

### Module 1: Dependencies & Package Health
1. **Remove Unused Packages:** Identify unused npm, pip, go, or cargo dependencies and propose removal.
2. **Update Dependencies:** Scan for out-of-date or vulnerable package versions (`npm audit`, `pip-audit`, `cargo audit`, or equivalent).

### Module 2: Secrets & Environment Management
3. **Check Git for Secrets:** Scan commit history and stage area for hardcoded keys, JWT secrets, passwords, or tokens using tools like `trufflehog` or regex pattern matching.
4. **Hide API Keys:** Verify that external API keys are excluded from source control and loaded strictly via environment variables.
5. **Check Environment Variables:** Audit `.env.example` templates to ensure sensitive defaults are not checked into Git, and verify proper runtime validation of required `.env` keys.
6. **Check Exposed Files:** Ensure sensitive files (`.env`, `.pem`, `.key`, `id_rsa`, `.DS_Store`, database dumps, build artifacts) are properly listed in `.gitignore`.

### Module 3: Authentication & Access Control
7. **Proper Authentication:** Verify session management, token handling (HTTP-only cookies vs. local storage), and token expiration/invalidation strategies.
8. **Hash Passwords Properly:** Ensure password hashing uses strong, modern algorithms (e.g., Argon2id, bcrypt with cost factor ≥12, scrypt) with appropriate salts—never plain SHA-256 or MD5.
9. **Check User Access:** Audit Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) implementation across authorization middleware.
10. **Protect Admin Routes:** Verify that privileged routes and endpoints require explicitly validated administrator scopes/roles and cannot be bypassed via parameter tampering.

### Module 4: API & Endpoint Protection
11. **Secure API Endpoints:** Ensure all public/private endpoints validate authorization headers, enforce proper HTTP verbs, and avoid mass assignment vulnerabilities.
12. **Add Rate Limiting:** Verify rate-limiting middleware is applied to sensitive endpoints (login, password reset, public APIs, payment routes) to prevent brute-force and DoS attacks.
13. **Check CORS Settings:** Inspect Cross-Origin Resource Sharing configurations to ensure wildcard origins (`*`) are prohibited in production setups with credentials.
14. **Secure DB Access:** Check for parameterized queries / ORM usage to prevent SQL/NoSQL injection, and verify database connection strings use SSL/TLS with least-privilege accounts.

### Module 5: Input Handling & Frontend Security
15. **Sanitize Forms:** Ensure all user inputs undergo strict server-side validation and sanitization.
16. **Protect Against XSS:** Audit template engines, React/Vue/Svelte renders, and HTML outputs to ensure proper contextual escaping and absence of unsafe functions (e.g., `dangerouslySetInnerHTML`, `eval()`, `innerHTML`).

### Module 6: System Configuration & Hardening
17. **Disable Debug Mode:** Verify debug flags, detailed stack traces, and verbose logging are disabled for production builds.
18. **Add Security Headers:** Ensure defensive HTTP response headers are set (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).
19. **Full Security Audit Integration:** Synthesize findings across all 18 rules into a consolidated risk matrix with clear severity scores (Critical, High, Medium, Low).

---

## 🛠️ Execution Instructions for Claude Code

When executing this skill:

1. **Information Gathering:**
   - Scan package manifests (`package.json`, `requirements.txt`, `Cargo.toml`, `go.mod`, `pom.xml`).
   - Inspect build configurations, `.gitignore`, `.env` templates, server entry points, and routing files.
   - Run native package vulnerability commands if accessible (e.g., `npm audit --json`).

2. **Codebase Inspection:**
   - Run pattern-matching scans for credentials and secrets across the workspace.
   - Trace authentication workflows, route protection middleware, and database queries.
   - Audit response headers and application settings.

3. **Report Generation:**
   - Group findings by severity (Critical, High, Medium, Low).
   - Provide concrete code references (`file_path:line_number`).
   - Deliver actionable code patches and remediation commands for every identified vulnerability.

---

## 📋 Output Format

Format the audit output using the following markdown structure:

```markdown
# 🛡️ Security Audit Findings

## Executive Summary
- **Total Issues Found:** X
- **Risk Breakdown:** 🔴 Critical: A | 🟠 High: B | 🟡 Medium: C | 🟢 Low: D

---

## 🔴 Critical & High Vulnerabilities

### 1. [Vulnerability Title]
- **Category:** [e.g., Secrets Exposure / Module 2]
- **File:** `path/to/file.ext:42`
- **Impact:** [Brief description of real-world exploitation risk]
- **Current Code:**
  ```language
  // Problematic snippet