File contents Security Audit
Is this safe?
When To Run
Before deploy
After adding auth/credentials
New endpoints
External inputs
What To Check
1. Credentials
# Hardcoded secrets?
grep -rn "sk-\|api_key\|password\|secret" . --include="*.js"
grep -rn "Bearer\|Token" . --include="*.js"
Check
Issue
Fix
Hardcoded API key
HIGH
Use env var
Password in code
HIGH
Use env
Token in logs
MEDIUM
Redact
2. Inputs
// Never trust user input
req.params.id
req.body.data
query.string
Check
Issue
Fix
SQL from input
HIGH
Parameterize
Eval input
HIGH
Remove eval
Shell from input
HIGH
No shell
File from input
HIGH
Validate path
3. Auth
// Check auth exists
function protected() {
if (!req.user) return error
// Good
}
Check
Issue
Fix
No auth check
HIGH
Add auth
Auth bypassed
HIGH
Fix
Weak auth
MEDIUM
Strengthen
4. Network
Check
Issue
HTTP not HTTPS
Use HTTPS
Credentials in URL
Headers only
No CORS
Set CORS
5. Filesystem
// Check file access
fs.readFile(userPath)
Check
Issue
Fix
Path traversal
HIGH
Sanitize
Read any file
HIGH
Validate
Write anywhere
HIGH
Restrict
Output
## Security Audit - [file]
### Credentials
- [PASS/FAIL] Hardcoded keys: [details]
### Inputs
- [PASS/FAIL] SQL injection: [details]
### Auth
- [PASS/FAIL] Protected: [details]
### Summary
| Severity | Count |
|----------|-------|
| HIGH | 0 |
| MEDIUM | 0 |
| LOW | 0 |
Severity
Severity
Meaning
HIGH
Exploit - fix now
MEDIUM
Risk - fix soon
LOW
Note - fix Optional
Role : Security AuditorInput : Code to reviewOutput : Issues found
1 --- 2 name: audit-security 3 description: Is this safe? 4 license: MIT 5 --- 6 7 # Security Audit 8 9 > Is this safe? 10 11 --- 12 13 ## When To Run 14 15 - Before deploy 16 - After adding auth/credentials 17 - New endpoints 18 - External inputs 19 20 --- 21 22 ## What To Check 23 24 ### 1. Credentials 25 26 ```bash 27 # Hardcoded secrets? 28 grep -rn "sk-\|api_key\|password\|secret" . --include="*.js" 29 grep -rn "Bearer\|Token" . --include="*.js" 30 ``` 31 32 | Check | Issue | Fix | 33 |-------|-------|-----| 34 | Hardcoded API key | HIGH | Use env var | 35 | Password in code | HIGH | Use env | 36 | Token in logs | MEDIUM | Redact | 37 38 ### 2. Inputs 39 40 ```javascript 41 // Never trust user input 42 req.params.id 43 req.body.data 44 query.string 45 ``` 46 47 | Check | Issue | Fix | 48 |-------|-------|-----| 49 | SQL from input | HIGH | Parameterize | 50 | Eval input | HIGH | Remove eval | 51 | Shell from input | HIGH | No shell | 52 | File from input | HIGH | Validate path | 53 54 ### 3. Auth 55 56 ```javascript 57 // Check auth exists 58 function protected() { 59 if (!req.user) return error 60 // Good 61 } 62 ``` 63 64 | Check | Issue | Fix | 65 |-------|-------|-----| 66 | No auth check | HIGH | Add auth | 67 | Auth bypassed | HIGH | Fix | 68 | Weak auth | MEDIUM | Strengthen | 69 70 ### 4. Network 71 72 | Check | Issue | 73 |-------|-------| 74 | HTTP not HTTPS | Use HTTPS | 75 | Credentials in URL | Headers only | 76 | No CORS | Set CORS | 77 78 ### 5. Filesystem 79 80 ```javascript 81 // Check file access 82 fs.readFile(userPath) 83 ``` 84 85 | Check | Issue | Fix | 86 |-------|-------|-----| 87 | Path traversal | HIGH | Sanitize | 88 | Read any file | HIGH | Validate | 89 | Write anywhere | HIGH | Restrict | 90 91 --- 92 93 ## Output 94 95 ``` 96 ## Security Audit - [file] 97 98 ### Credentials 99 - [PASS/FAIL] Hardcoded keys: [details] 100 101 ### Inputs 102 - [PASS/FAIL] SQL injection: [details] 103 104 ### Auth 105 - [PASS/FAIL] Protected: [details] 106 107 ### Summary 108 | Severity | Count | 109 |----------|-------| 110 | HIGH | 0 | 111 | MEDIUM | 0 | 112 | LOW | 0 | 113 ``` 114 115 --- 116 117 ## Severity 118 119 | Severity | Meaning | 120 |----------|---------| 121 | HIGH | Exploit - fix now | 122 | MEDIUM | Risk - fix soon | 123 | LOW | Note - fix Optional | 124 125 --- 126 127 **Role**: Security Auditor 128 **Input**: Code to review 129 **Output**: Issues found
commit 7fd9c11059
Frequently asked questions How do I install the Audit Security skill? Run npx skillmds@latest add dhaupin/audit-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
What does the Audit Security skill do? Is this safe? It is listed under Security on SkillMD.
Is Audit Security safe to use? This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
Which AI agents work with Audit Security? This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Is Audit Security free to use? Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.
Who published Audit Security? dhaupin (@dhaupin) published this skill. Their other Agent Skills are listed on their SkillMD profile.
dhaupin