# Security Audit Creation

> Generate security audit documentation following the SECURITY-AUDIT template. Use when performing security reviews, checking for vulnerabilities, or when the user asks for a security audit.

- Skill: `majiayu000/security-audit-creation` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-audit-creation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-audit-creation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-audit-creation

---


# Security Audit Creation Skill

> **Purpose:** Generate comprehensive security audit documentation. Ensures security reviews are thorough and remediation is tracked.

## Trigger

**When:** Pre-deployment review OR compliance audit OR security concern raised
**Context Needed:** Code to review, threat model, compliance requirements
**MCP Tools:** `mcp_payment-syste_search_full_text`, `read_file`, `grep_search`

## Required Sections

```markdown
# [Feature/System] - Security Audit

## Audit Metadata

- Date: YYYY-MM-DD
- Auditor: @username
- Scope: [description]
- Classification: internal | confidential

## Executive Summary

[High-level findings]

## Threat Model

### Assets

- [asset]: [classification]

### Threat Actors

- [actor]: [capability]

### Attack Vectors

- [vector]: [mitigation]

## Findings

### Critical

| ID  | Title | Status | Remediation |
| :-- | :---- | :----- | :---------- |

### High

...

### Medium

...

### Low

...

## Compliance Status

- [ ] OWASP Top 10
- [ ] PCI-DSS (if applicable)
- [ ] GDPR (if applicable)
```

## OWASP Top 10 Checklist

```markdown
## OWASP Top 10 (2021)

| #   | Category                  | Status   | Notes |
| :-- | :------------------------ | :------- | :---- |
| A01 | Broken Access Control     | ✅/⚠️/❌ |       |
| A02 | Cryptographic Failures    | ✅/⚠️/❌ |       |
| A03 | Injection                 | ✅/⚠️/❌ |       |
| A04 | Insecure Design           | ✅/⚠️/❌ |       |
| A05 | Security Misconfiguration | ✅/⚠️/❌ |       |
| A06 | Vulnerable Components     | ✅/⚠️/❌ |       |
| A07 | Auth Failures             | ✅/⚠️/❌ |       |
| A08 | Software/Data Integrity   | ✅/⚠️/❌ |       |
| A09 | Security Logging          | ✅/⚠️/❌ |       |
| A10 | SSRF                      | ✅/⚠️/❌ |       |
```

## Finding Format

```markdown
### FINDING-001: [Title]

**Severity:** Critical | High | Medium | Low
**Category:** OWASP A0X
**Status:** Open | In Progress | Resolved

**Description:**
[What was found]

**Impact:**
[Potential damage]

**Reproduction:**

1. [step]
2. [step]

**Recommendation:**
[How to fix]

**Remediation Timeline:**

- Target: YYYY-MM-DD
- Owner: @username
```

## Reference

- [09-SECURITY-AUDIT-TEMPLATE.md](/docs/templates/09-SECURITY-AUDIT-TEMPLATE.md)
- [SECURITY-ARCHITECTURE.md](/docs/technical/architecture/SECURITY-ARCHITECTURE.md)