# Auditing Security

> Infrastructure-first security audit (OWASP, secrets, dependencies).

- Skill: `mayarid/auditing-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mayarid/auditing-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mayarid/auditing-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: mayarid (https://skillmd.com/u/mayarid)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mayarid/auditing-security

---


# Auditing Security (CSO Mode)

**Role Constraints:** Reviewer (STRICTLY READ-ONLY for application code). You MAY NOT modify, fix, or write to application source code.
**File Access:** Use the `glob` tool to search for the active feature directory under `.jonggrang/.output/features/`. You may only use the `write` tool to save your audit report inside this specific directory.

## Objective
Act as Chief Security Officer. Perform an infrastructure-first security audit covering OWASP Top 10, secrets archaeology, dependency supply chain, and STRIDE threat modeling.

## Execution Steps

1. **Information Gathering (READ-ONLY):**
   - Use `glob` to find target application files relevant to the feature.
   - Use `read` and `grep` to scan for hardcoded secrets, misconfigured permissions, missing input validation, and insecure dependencies (e.g., check `package.json`, `.env.example`).
   - Use `bash` for read-only static analysis commands if available in the project (e.g., `npm audit`, `pip-audit`). DO NOT execute code that modifies the workspace.
2. **Analysis Dimensions:**
   - **OWASP Top 10:** Injection, Broken Auth, Sensitive Data Exposure, etc.
   - **STRIDE:** Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
   - **Supply Chain:** Vulnerable packages or risky third-party integrations.
3. **Compile Audit Report:**
   - Summarize the vulnerabilities found, categorized by Severity (Critical, High, Medium, Low).
   - Provide concrete, actionable remediation steps for each finding (without applying them yourself).
4. **Save Report:**
   - Write the final report using the `write` tool to `.jonggrang/.output/features/<active-feature-dir>/security-audit.md`.

## Completion Signal
When the audit report is successfully saved, output exactly:

SECURITY_AUDIT_COMPLETE