# Security Audit

> Comprehensive security audit covering OWASP Top 10, input validation, authentication, authorization, secret management, dependency vulnerabilities, and injection attack prevention. Use when reviewing security posture, implementing auth flows, handling user input, auditing dependencies, conducting penetration test prep, or before production deployment.

- Skill: `kcenon/security-audit` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add kcenon/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kcenon/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: kcenon (https://skillmd.com/u/kcenon)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/kcenon/security-audit

---


# Security Audit Skill

## When to Use

- Implementing authentication/authorization
- Handling user input
- Working with sensitive data (passwords, tokens, keys)
- Security review requests
- Designing API endpoints

## Security Checklist

### Input Validation

- [ ] Validate all user input
- [ ] Prevent SQL Injection
- [ ] Prevent XSS
- [ ] Prevent Command Injection

### Authentication

- [ ] Secure password hashing
- [ ] Session management
- [ ] JWT security settings

### Authorization

- [ ] Permission verification
- [ ] Resource access control

## Reference Documents (Import Syntax)
@./reference/security.md
@./reference/error-handling.md
@./reference/api-design.md

## OWASP Top 10 Reference

1. Injection
2. Broken Authentication
3. Sensitive Data Exposure
4. XML External Entities (XXE)
5. Broken Access Control
6. Security Misconfiguration
7. Cross-Site Scripting (XSS)
8. Insecure Deserialization
9. Using Components with Known Vulnerabilities
10. Insufficient Logging & Monitoring

## Output

This skill runs in a forked context (`context: fork`) using the read-only `Explore` agent. It does not have access to the calling conversation's history — operate entirely from the supplied `<file-or-directory>` argument.

Return a structured report at the end of analysis:

```markdown
## Security Audit Report

| Severity | Findings |
|----------|----------|
| S1 (block-merge) | N items |
| S2 (review-required) | N items |
| S3 (advisory) | N items |

### S1 Findings
1. `file.ext:line` — severity: S1 — finding + recommended fix
2. ...

### S2 Findings
1. `file.ext:line` — severity: S2 — finding + recommended fix

### Coverage
- Files inspected: N
- OWASP categories evaluated: 1, 2, 3, ...
- Categories not applicable: ...
```

Each finding MUST include a `severity:` field (`S1`, `S2`, or `S3`). When a finding's severity is ambiguous, default to `S3` (advisory) per the false-positive playbook.