# Security Audit

> Audits codebases for security vulnerabilities, secrets exposure, auth risks, dependency health, and misconfigurations.

- Skill: `alimansoor2003/security-audit` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add alimansoor2003/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/alimansoor2003/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: alimansoor2003 (https://skillmd.com/u/alimansoor2003)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/alimansoor2003/security-audit

---


# Security Audit Skill

Execute a comprehensive, end-to-end security audit on the current codebase. Inspect source code, configurations, dependencies, and environment files to identify and remediate security vulnerabilities across 19 critical checkpoints.

---

## 🎯 Scope & Objectives

When invoked (`/security-audit` or when asked to perform a security check), analyze the repository against the following 6 domain modules:

### Module 1: Dependencies & Package Health
1. **Remove Unused Packages:** Identify unused npm, pip, go, or cargo dependencies and propose removal.
2. **Update Dependencies:** Scan for out-of-date or vulnerable package versions (`npm audit`, `pip-audit`, `cargo audit`, or equivalent).

### Module 2: Secrets & Environment Management
3. **Check Git for Secrets:** Scan commit history and stage area for hardcoded keys, JWT secrets, passwords, or tokens using tools like `trufflehog` or regex pattern matching.
4. **Hide API Keys:** Verify that external API keys are excluded from source control and loaded strictly via environment variables.
5. **Check Environment Variables:** Audit `.env.example` templates to ensure sensitive defaults are not checked into Git, and verify proper runtime validation of required `.env` keys.
6. **Check Exposed Files:** Ensure sensitive files (`.env`, `.pem`, `.key`, `id_rsa`, `.DS_Store`, database dumps, build artifacts) are properly listed in `.gitignore`.

### Module 3: Authentication & Access Control
7. **Proper Authentication:** Verify session management, token handling (HTTP-only cookies vs. local storage), and token expiration/invalidation strategies.
8. **Hash Passwords Properly:** Ensure password hashing uses strong, modern algorithms (e.g., Argon2id, bcrypt with cost factor ≥12, scrypt) with appropriate salts—never plain SHA-256 or MD5.
9. **Check User Access:** Audit Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) implementation across authorization middleware.
10. **Protect Admin Routes:** Verify that privileged routes and endpoints require explicitly validated administrator scopes/roles and cannot be bypassed via parameter tampering.

### Module 4: API & Endpoint Protection
11. **Secure API Endpoints:** Ensure all public/private endpoints validate authorization headers, enforce proper HTTP verbs, and avoid mass assignment vulnerabilities.
12. **Add Rate Limiting:** Verify rate-limiting middleware is applied to sensitive endpoints (login, password reset, public APIs, payment routes) to prevent brute-force and DoS attacks.
13. **Check CORS Settings:** Inspect Cross-Origin Resource Sharing configurations to ensure wildcard origins (`*`) are prohibited in production setups with credentials.
14. **Secure DB Access:** Check for parameterized queries / ORM usage to prevent SQL/NoSQL injection, and verify database connection strings use SSL/TLS with least-privilege accounts.

### Module 5: Input Handling & Frontend Security
15. **Sanitize Forms:** Ensure all user inputs undergo strict server-side validation and sanitization.
16. **Protect Against XSS:** Audit template engines, React/Vue/Svelte renders, and HTML outputs to ensure proper contextual escaping and absence of unsafe functions (e.g., `dangerouslySetInnerHTML`, `eval()`, `innerHTML`).

### Module 6: System Configuration & Hardening
17. **Disable Debug Mode:** Verify debug flags, detailed stack traces, and verbose logging are disabled for production builds.
18. **Add Security Headers:** Ensure defensive HTTP response headers are set (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).
19. **Full Security Audit Integration:** Synthesize findings across all 18 rules into a consolidated risk matrix with clear severity scores (Critical, High, Medium, Low).

---

## 🛠️ Execution Instructions for Claude Code

When executing this skill:

1. **Information Gathering:**
   - Scan package manifests (`package.json`, `requirements.txt`, `Cargo.toml`, `go.mod`, `pom.xml`).
   - Inspect build configurations, `.gitignore`, `.env` templates, server entry points, and routing files.
   - **Actually run the dependency-vulnerability command for whichever manifest is present** — do not just describe what it might find. Match the manifest to its tool: `package.json` → `npm audit --json` (or `pnpm audit` / `yarn audit` if that lockfile is present instead), `requirements.txt` → `pip-audit`, `Cargo.toml` → `cargo audit`, `go.mod` → `govulncheck ./...`. If more than one manifest is present, run each.
   - If the matching tool isn't installed, don't skip the checkpoint silently — say so explicitly in the report (e.g., "Update Dependencies: not run, `pip-audit` is not installed in this environment") rather than omitting it or treating it as a pass.

2. **Codebase Inspection:**
   - Run pattern-matching scans for credentials and secrets across the workspace.
   - Trace authentication workflows, route protection middleware, and database queries.
   - Audit response headers and application settings.

3. **Report Generation:**
   - Group findings by severity (Critical, High, Medium, Low).
   - Provide concrete code references (`file_path:line_number`).
   - Deliver actionable code patches and remediation commands for every identified vulnerability.

---

## 📋 Output Format

Format the audit output using the following markdown structure:

```markdown
# 🛡️ Security Audit Findings

## Executive Summary
- **Total Issues Found:** X
- **Risk Breakdown:** 🔴 Critical: A | 🟠 High: B | 🟡 Medium: C | 🟢 Low: D

---

## 🔴 Critical & High Vulnerabilities

### 1. [Vulnerability Title]
- **Category:** [e.g., Secrets Exposure / Module 2]
- **File:** `path/to/file.ext:42`
- **Impact:** [Brief description of real-world exploitation risk]
- **Current Code:**
  ```language
  // Problematic snippet
  ```
- **Remediation:**
  ```language
  // Corrected snippet
  ```
- **Remediation Command** (if applicable): `npm install package@latest`

*(Repeat per Critical/High finding.)*

---

## 🟡 Medium & 🟢 Low Vulnerabilities

### N. [Finding Title]
- **Category:** [Module reference]
- **File:** `path/to/file.ext:line`
- **Impact:** [Brief description]
- **Recommendation:** [Concrete fix, one or two lines]

*(Repeat per Medium/Low finding. These may be listed more tersely than Critical/High.)*

---

## ✅ Passed Checks

List checkpoints (by number, 1–19) that were inspected and found compliant, so the report shows full coverage rather than only problems.

---

## 📊 Risk Matrix

| # | Checkpoint | Module | Status | Severity |
|---|---|---|---|---|
| 1 | Remove Unused Packages | 1 | ⚠️ Issue | Low |
| 2 | Update Dependencies | 1 | ✅ Pass | — |
| … | … | … | … | … |

---

## 🧭 Next Steps

Ordered remediation checklist, Critical first, with the estimated effort for each (e.g., "single-line fix" vs. "requires design change").
```

---

## ⚠️ Ground Rules

- **Never fabricate a finding.** Every reported issue must cite a real file and line; if a checkpoint cannot be verified (no test runner, no lockfile, etc.), say so in Passed Checks / a "Not Applicable" note rather than guessing.
- **Never auto-apply fixes without being asked.** This skill reports and proposes remediation; it does not silently rewrite auth, database, or payment code. Ask before editing anything security-critical.
- **Read secrets, never print them.** When Module 2 checks turn up a real credential, report its location and redact the value in the report itself.
- **Prefer the project's existing tools.** Use whatever audit/lint tooling the repo already has configured (`npm audit`, `pip-audit`, existing ESLint security rules) before reaching for an external scanner.