How do I install the Security Audit skill?

Run npx skillmds add netresearch-security-audit-skill/security-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Audit free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under (MIT AND CC-BY-SA-4.

Who published Security Audit?

netresearch (@netresearch-security-audit-skill) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Audit by netresearch-security-audit-skill

Name: Security Audit
Rating: 4.666666666666667 (3 reviews)
Author: netresearch

Security Audit

Use when conducting security assessments — OWASP Top 10 / API / LLM, CWE Top 25, CVSS scoring — auditing PHP/TYPO3, APIs, frontend, Terraform/K8s/Docker IaC, AWS cloud, AI agent configs, or scanning dependencies.

netresearch c3a736a 61 files · 1.2 MB Updated Sep 9, 2026

File contents

Security Audit Skill

Security audit patterns (OWASP Top 10, LLM Top 10 2025, CWE Top 25 2025, CVSS v4.0), cloud/IaC, GitHub security. 80+ PHP/TYPO3 checkpoints (v14.3 LTS in typo3-security.md).

Expertise Areas

Vulnerabilities: XXE, SQLi, XSS, CSRF, command injection, path traversal, file upload, deserialization, SSRF, SSTI, JWT, type juggling
Standards: OWASP Top 10 / API / LLM (2025), CWE Top 25, CVSS v3.1/v4.0, OWASP ASVS
Cloud & IaC: AWS; Terraform, Kubernetes, Docker, Helm
API & Frontend: REST/GraphQL authZ, rate limits, mass assignment, CSP, DOM-XSS
AI Agents: SKILL.md/AGENTS.md/CLAUDE.md/mcp.json/hooks.json audit; prompt injection; excessive agency

Reference Files (in `references/`, `.md` implied)

Core: owasp-top10, cwe-top25, xxe-prevention, cvss-scoring, api-key-encryption
Prevention: deserialization-prevention, path-traversal-prevention, file-upload-security, input-validation, error-message-sanitization
Architecture: authentication-patterns, security-headers, security-logging, cryptography-guide, security-invariants, indistinguishability-defences
Language features (*-security-features): php, python, javascript-typescript, nodejs, go
Frameworks (*-security): typo3, typo3-fluid, typo3-typoscript, symfony, react, vue
Cloud & IaC: aws-security, iac-security
API & Frontend: api-security, frontend-security
AI Agent: llm-security (OWASP LLM Top 10 2025)
Threats: modern-attacks, cve-patterns
DevSecOps: ci-security-pipeline, supply-chain-security, automated-scanning, gha-security, git-history-secrets
Incident: supply-chain-incident-response

Security Checklist

semgrep/opengrep, trivy fs --severity HIGH,CRITICAL, gitleaks clean
bcrypt/Argon2 passwords, CSRF on state changes, TLS 1.2+
Server-side input validation; parameterized SQL; XML entities off
Output encoding + CSP; no unserialize() on user input
API keys encrypted; exception messages sanitized
Secrets out of VCS; audit logging on
Uploads validated, renamed, outside web root
Headers HSTS + X-Content-Type-Options; dependencies scanned

GitHub Actions Security

NEVER interpolate ${{ inputs.* }} / ${{ github.event.* }} in run: — use env:
Dependency triage: upgrade > override > dismiss. Full patterns: references/gha-security.md.

Verification

./scripts/security-audit-dispatcher.sh /path/to/project  # auto-detect stack
./scripts/security-audit.sh /path/to/project             # PHP-only
./scripts/github-security-audit.sh owner/repo            # GH repo

Dispatcher detects the stack from indicator files and runs matching scripts/scanners/*.sh (13 ecosystems; see references/ index).

Contributing: https://github.com/netresearch/security-audit-skill

---name: security-auditdescription: Use when conducting security assessments — OWASP Top 10 / API / LLM, CWE Top 25, CVSS scoring — auditing PHP/TYPO3, APIs, frontend, Terraform/K8s/Docker IaC, AWS cloud, AI agent configs, or scanning dependencies.license: (MIT AND CC-BY-SA-4.0). See LICENSE-MIT and LICENSE-CC-BY-SA-4.0--- # Security Audit Skill Security audit patterns (OWASP Top 10, LLM Top 10 2025, CWE Top 25 2025, CVSS v4.0), cloud/IaC, GitHub security. 80+ PHP/TYPO3 checkpoints (v14.3 LTS in `typo3-security.md`). ## Expertise Areas - **Vulnerabilities**: XXE, SQLi, XSS, CSRF, command injection, path traversal, file upload, deserialization, SSRF, SSTI, JWT, type juggling - **Standards**: OWASP Top 10 / API / LLM (2025), CWE Top 25, CVSS v3.1/v4.0, OWASP ASVS - **Cloud & IaC**: AWS; Terraform, Kubernetes, Docker, Helm - **API & Frontend**: REST/GraphQL authZ, rate limits, mass assignment, CSP, DOM-XSS - **AI Agents**: SKILL.md/AGENTS.md/CLAUDE.md/mcp.json/hooks.json audit; prompt injection; excessive agency ## Reference Files (in `references/`, `.md` implied) - **Core**: owasp-top10, cwe-top25, xxe-prevention, cvss-scoring, api-key-encryption - **Prevention**: deserialization-prevention, path-traversal-prevention, file-upload-security, input-validation, error-message-sanitization - **Architecture**: authentication-patterns, security-headers, security-logging, cryptography-guide, security-invariants, indistinguishability-defences - **Language features** (`*-security-features`): php, python, javascript-typescript, nodejs, go - **Frameworks** (`*-security`): typo3, typo3-fluid, typo3-typoscript, symfony, react, vue - **Cloud & IaC**: aws-security, iac-security - **API & Frontend**: api-security, frontend-security - **AI Agent**: llm-security (OWASP LLM Top 10 2025) - **Threats**: modern-attacks, cve-patterns - **DevSecOps**: ci-security-pipeline, supply-chain-security, automated-scanning, gha-security, git-history-secrets - **Incident**: supply-chain-incident-response ## Security Checklist - [ ] `semgrep`/`opengrep`, `trivy fs --severity HIGH,CRITICAL`, `gitleaks` clean - [ ] bcrypt/Argon2 passwords, CSRF on state changes, TLS 1.2+ - [ ] Server-side input validation; parameterized SQL; XML entities off - [ ] Output encoding + CSP; no unserialize() on user input - [ ] API keys encrypted; exception messages sanitized - [ ] Secrets out of VCS; audit logging on - [ ] Uploads validated, renamed, outside web root - [ ] Headers HSTS + X-Content-Type-Options; dependencies scanned ## GitHub Actions Security - **NEVER** interpolate `${{ inputs.* }}` / `${{ github.event.* }}` in `run:` — use `env:` - Dependency triage: upgrade > override > dismiss. Full patterns: `references/gha-security.md`. ## Verification ```bash ./scripts/security-audit-dispatcher.sh /path/to/project # auto-detect stack ./scripts/security-audit.sh /path/to/project # PHP-only ./scripts/github-security-audit.sh owner/repo # GH repo ``` Dispatcher detects the stack from indicator files and runs matching `scripts/scanners/*.sh` (13 ecosystems; see `references/` index). --- > Contributing: https://github.com/netresearch/security-audit-skill

Frequently asked questions