How do I install the Security Audit skill?

Run npx skillmds add majiayu000/security-audit-16 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Audit?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Audit by majiayu000 — Agent Skill

Name: Security Audit
Rating: 4.5 (4 reviews)
Author: majiayu000

File contents

/security-audit

Multi-agent security audit with findings saved to timestamped report.

Usage

/security-audit yourbench           # Full security review
/security-audit coordinatr          # Audit specific project

Audit Dimensions

Five security-auditor agents run in parallel:

Agent	Focus Area	Checks
Agent 1: Auth & Access	Authentication, Authorization	JWT handling, session management, RBAC, privilege escalation
Agent 2: Input & Data	Injection, Validation	SQL injection, XSS, command injection, input sanitization
Agent 3: Crypto & Secrets	Cryptography, Secrets	Hardcoded credentials, weak crypto, key management, PII
Agent 4: Config & Deploy	Configuration, Infrastructure	CORS, CSRF, security headers, exposed endpoints, debug mode
Agent 5: Dependencies	Supply Chain, Libraries	Vulnerable packages, outdated deps, license issues

OWASP Top 10 Coverage

OWASP Risk	Coverage
A01 Broken Access Control	Agent 1
A02 Cryptographic Failures	Agent 3
A03 Injection	Agent 2
A04 Insecure Design	Agents 1, 4
A05 Security Misconfiguration	Agent 4
A06 Vulnerable Components	Agent 5
A07 Auth Failures	Agent 1
A08 Data Integrity Failures	Agents 2, 3
A09 Logging Failures	Agent 4
A10 SSRF	Agent 2

Execution Flow

1. Validate Project

ls spaces/[project]/

2. Launch Parallel Audits

5 security-auditor agents run concurrently with focused prompts.

3. Consolidate Findings

Aggregate by:

Severity: Critical, High, Medium, Low, Info
Category: OWASP classification
Location: File path + line number
Remediation: Specific fix guidance

4. Generate Report

Write: .claude/temp/security-audit-[project]-[timestamp].md

Report Structure

# Security Audit: [Project Name]
**Date**: YYYY-MM-DD HH:MM:SS

## Executive Summary
- Critical issues: X
- High severity: Y
- Total findings: Z

## Critical Issues
### [Issue Title]
- **Severity**: Critical
- **Category**: SQL Injection (CWE-89)
- **Location**: src/api/users.py:42
- **Description**: [What's wrong]
- **Impact**: [What could happen]
- **Remediation**: [How to fix]

## High Severity Issues
[...]

## Recommendations
- Priority actions
- Long-term improvements

## Scan Coverage
- Files scanned: X
- Technologies: Z

When to Use

Before production deployments
After major feature additions
Monthly security reviews
Before external security audits
After dependency updates

Output Location

.claude/temp/security-audit-yourbench-2026-01-08-143022.md

Reports saved to .claude/temp/ (gitignored) for review.

Notes

Read-only: No code changes made
Non-blocking: Doesn't prevent commits
Parallel execution: Agents run concurrently
False positives possible: Manual review recommended

Integration

Implement security feature → /security-audit → Fix issues → /commit

---name: security-audit-16description: Comprehensive security audit of codebase using multiple security-auditor agents. Use before production deployments or after major features.--- # /security-audit Multi-agent security audit with findings saved to timestamped report. ## Usage ```bash /security-audit yourbench # Full security review /security-audit coordinatr # Audit specific project ``` ## Audit Dimensions Five security-auditor agents run in parallel: | Agent | Focus Area | Checks | |-------|------------|--------| | **Agent 1: Auth & Access** | Authentication, Authorization | JWT handling, session management, RBAC, privilege escalation | | **Agent 2: Input & Data** | Injection, Validation | SQL injection, XSS, command injection, input sanitization | | **Agent 3: Crypto & Secrets** | Cryptography, Secrets | Hardcoded credentials, weak crypto, key management, PII | | **Agent 4: Config & Deploy** | Configuration, Infrastructure | CORS, CSRF, security headers, exposed endpoints, debug mode | | **Agent 5: Dependencies** | Supply Chain, Libraries | Vulnerable packages, outdated deps, license issues | ## OWASP Top 10 Coverage | OWASP Risk | Coverage | |------------|----------| | A01 Broken Access Control | Agent 1 | | A02 Cryptographic Failures | Agent 3 | | A03 Injection | Agent 2 | | A04 Insecure Design | Agents 1, 4 | | A05 Security Misconfiguration | Agent 4 | | A06 Vulnerable Components | Agent 5 | | A07 Auth Failures | Agent 1 | | A08 Data Integrity Failures | Agents 2, 3 | | A09 Logging Failures | Agent 4 | | A10 SSRF | Agent 2 | ## Execution Flow ### 1. Validate Project ```bash ls spaces/[project]/ ``` ### 2. Launch Parallel Audits 5 security-auditor agents run concurrently with focused prompts. ### 3. Consolidate Findings Aggregate by: - **Severity**: Critical, High, Medium, Low, Info - **Category**: OWASP classification - **Location**: File path + line number - **Remediation**: Specific fix guidance ### 4. Generate Report ```bash Write: .claude/temp/security-audit-[project]-[timestamp].md ``` ## Report Structure ```markdown # Security Audit: [Project Name] **Date**: YYYY-MM-DD HH:MM:SS ## Executive Summary - Critical issues: X - High severity: Y - Total findings: Z ## Critical Issues ### [Issue Title] - **Severity**: Critical - **Category**: SQL Injection (CWE-89) - **Location**: src/api/users.py:42 - **Description**: [What's wrong] - **Impact**: [What could happen] - **Remediation**: [How to fix] ## High Severity Issues [...] ## Recommendations - Priority actions - Long-term improvements ## Scan Coverage - Files scanned: X - Technologies: Z ``` ## When to Use - Before production deployments - After major feature additions - Monthly security reviews - Before external security audits - After dependency updates ## Output Location ``` .claude/temp/security-audit-yourbench-2026-01-08-143022.md ``` Reports saved to `.claude/temp/` (gitignored) for review. ## Notes - **Read-only**: No code changes made - **Non-blocking**: Doesn't prevent commits - **Parallel execution**: Agents run concurrently - **False positives possible**: Manual review recommended ## Integration ``` Implement security feature → /security-audit → Fix issues → /commit ```

Frequently asked questions