How do I install the Security Audit skill?

Run npx skillmds@latest add kcenon/security-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Audit?

kcenon (@kcenon) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Audit by kcenon — Agent Skill

Name: Security Audit
Rating: 4.2 (5 reviews)
Author: kcenon

Security Audit

Comprehensive security audit covering OWASP Top 10, input validation, authentication, authorization, secret management, dependency vulnerabilities, and injection attack prevention. Use when reviewing security posture, implementing auth flows, handling user input, auditing dependencies, conducting penetration test prep, or before production deployment.

kcenon Updated Sep 10, 2026

File contents

Security Audit Skill

When to Use

Implementing authentication/authorization
Handling user input
Working with sensitive data (passwords, tokens, keys)
Security review requests
Designing API endpoints

Security Checklist

Input Validation

Validate all user input
Prevent SQL Injection
Prevent XSS
Prevent Command Injection

Authentication

Secure password hashing
Session management
JWT security settings

Authorization

Permission verification
Resource access control

Reference Documents (Import Syntax)

@./reference/security.md @./reference/error-handling.md @./reference/api-design.md

OWASP Top 10 Reference

Injection
Broken Authentication
Sensitive Data Exposure
XML External Entities (XXE)
Broken Access Control
Security Misconfiguration
Cross-Site Scripting (XSS)
Insecure Deserialization
Using Components with Known Vulnerabilities
Insufficient Logging & Monitoring

Output

This skill runs in a forked context (context: fork) using the read-only Explore agent. It does not have access to the calling conversation's history — operate entirely from the supplied <file-or-directory> argument.

Return a structured report at the end of analysis:

## Security Audit Report

| Severity | Findings |
|----------|----------|
| S1 (block-merge) | N items |
| S2 (review-required) | N items |
| S3 (advisory) | N items |

### S1 Findings
1. `file.ext:line` — severity: S1 — finding + recommended fix
2. ...

### S2 Findings
1. `file.ext:line` — severity: S2 — finding + recommended fix

### Coverage
- Files inspected: N
- OWASP categories evaluated: 1, 2, 3, ...
- Categories not applicable: ...

Each finding MUST include a severity: field (S1, S2, or S3). When a finding's severity is ambiguous, default to S3 (advisory) per the false-positive playbook.

---name: security-auditdescription: Comprehensive security audit covering OWASP Top 10, input validation, authentication, authorization, secret management, dependency vulnerabilities, and injection attack prevention. Use when reviewing security posture, implementing auth flows, handling user input, auditing dependencies, conducting penetration test prep, or before production deployment.---# Security Audit Skill## When to Use- Implementing authentication/authorization- Handling user input- Working with sensitive data (passwords, tokens, keys)- Security review requests- Designing API endpoints## Security Checklist### Input Validation- [ ] Validate all user input- [ ] Prevent SQL Injection- [ ] Prevent XSS- [ ] Prevent Command Injection### Authentication- [ ] Secure password hashing- [ ] Session management- [ ] JWT security settings### Authorization- [ ] Permission verification- [ ] Resource access control## Reference Documents (Import Syntax)@./reference/security.md@./reference/error-handling.md@./reference/api-design.md## OWASP Top 10 Reference1. Injection2. Broken Authentication3. Sensitive Data Exposure4. XML External Entities (XXE)5. Broken Access Control6. Security Misconfiguration7. Cross-Site Scripting (XSS)8. Insecure Deserialization9. Using Components with Known Vulnerabilities10. Insufficient Logging & Monitoring## OutputThis skill runs in a forked context (`context: fork`) using the read-only `Explore` agent. It does not have access to the calling conversation's history — operate entirely from the supplied `<file-or-directory>` argument.Return a structured report at the end of analysis:```markdown## Security Audit Report| Severity | Findings ||----------|----------|| S1 (block-merge) | N items || S2 (review-required) | N items || S3 (advisory) | N items |### S1 Findings1. `file.ext:line` — severity: S1 — finding + recommended fix2. ...### S2 Findings1. `file.ext:line` — severity: S2 — finding + recommended fix### Coverage- Files inspected: N- OWASP categories evaluated: 1, 2, 3, ...- Categories not applicable: ...```Each finding MUST include a `severity:` field (`S1`, `S2`, or `S3`). When a finding's severity is ambiguous, default to `S3` (advisory) per the false-positive playbook.

Frequently asked questions