# Security

> Audit code and workflows for practical security issues including auth flaws, injection risk, insecure defaults, data exposure, and secrets handling.

- Skill: `arogyareddy/security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add arogyareddy/security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/arogyareddy/security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: arogyareddy (https://skillmd.com/u/arogyareddy)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/arogyareddy/security

---


# Security

Use this for feature reviews, auth flows, API endpoints, config audits, and pre-release hardening.

## Checklist
- Authentication and authorization correctness.
- Input validation and output encoding.
- Injection risk: SQL, command, template, HTML, path traversal.
- Secret handling, token leakage, verbose logs.
- Session, cookie, CSRF, CORS, and redirect handling.
- Unsafe file upload/download behavior.
- Dependency and config risk.

## Workflow
1. Map trust boundaries.
2. Identify external inputs and privileged actions.
3. Check authorization at the actual execution point.
4. Check data exposure in logs, errors, traces, and client responses.
5. Identify exploit path, impact, and fix.

## Output format
- Findings by severity
- Exploit scenario
- Fix recommendation
- Validation steps