How do I install the Security Audit skill?

Run npx skillmds@latest add nuwansamaranayake/security-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Audit?

nuwansamaranayake (@nuwansamaranayake) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Audit by nuwansamaranayake

Name: Security Audit
Author: nuwansamaranayake

Security Audit

Runs the three-pass AiGNITE security audit on any mobile or backend project before deployment. Identifies vulnerabilities, applies fixes, and re-audits to catch regressions introduced by the fixes. Produces a tier-classified SECURITY_AUDIT.md with CWE references. Use this skill whenever the user mentions a security audit, pre-deploy check, asking whether code is safe to ship, vulnerability check, security review, or auditing an app, even if they do not name the skill by name.

nuwansamaranayake 93a2981 9 files · 25.2 KB Updated Sep 17, 2026

File contents

security-audit

Purpose

Find the security gaps that block a clean TestFlight or Play Store submission. Fix the Critical and High issues. Confirm the fixes did not introduce new gaps. Hand back a signed audit document.

When to trigger

Trigger on these user phrases. Match loosely.

"security audit"
"pre-deploy check"
"is this safe to ship"
"check for vulnerabilities"
"security review"
"audit my app"
"OWASP check"
"ready for App Store"

Behavior: three passes

Pass 1: identify

Scan the entire project. Produce findings tagged Critical, High, Medium, Low with CWE references. Write to SECURITY_AUDIT.md.

Checks the skill runs:

Hard-coded secrets in source (CWE-798)
Exposed environment variables in client bundles (CWE-200)
Missing server-side validation on API routes (CWE-20)
Default-open database policies (CWE-732)
Missing or inconsistent auth middleware (CWE-287)
Hallucinated package imports (CWE-829)
Console logs leaking request bodies or tokens (CWE-532)
Missing rate limiting on expensive operations (CWE-770)
CORS misconfigurations (CWE-942)
SQL injection patterns in raw queries (CWE-89)
XSS in user-supplied content paths (CWE-79)
Insecure deep linking handlers (CWE-925)
Hard-coded API URLs pointing at staging (CWE-1188)

Pass 2: fix

Implement fixes for every Critical and High finding. Apply Medium and Low fixes if the user opts in. After each fix, update SECURITY_AUDIT.md with the resolution and the diff link.

Pass 3: re-audit

Run the full scan again from a fresh context. Compare to pass 1. Flag any new finding introduced by a pass-2 fix. The most common new findings: a fix that broadens an auth check, a fix that adds a console log, a fix that imports a new package without validating it.

If pass 3 surfaces new findings, fix them, run a fourth pass. Stop when a pass introduces zero new Critical or High findings.

Output: SECURITY_AUDIT.md

The skill writes SECURITY_AUDIT.md at the project root using the template in assets/templates/SECURITY_AUDIT.md.template. The document includes:

Project name and audit date
Pass-1 findings table
Pass-2 resolution log
Pass-3 regression check
Final tier counts
Sign-off block

The audit fails (returns non-zero) until every Critical and High finding has a resolution.

Refusals

Refuse to mark an audit complete if:

Any Critical finding remains unresolved.
Any High finding remains unresolved without explicit user override.
Pass 3 surfaced a Critical or High introduced by a pass-2 fix.

Composes with

Runs after supabase-bootstrap to verify the schema and policies.
Runs before app-store-submission. The submission skill refuses if no recent audit exists.
The mcp-to-mobile skill invokes this skill in step 9.

References

references/vulnerability-patterns.md - the full taxonomy with examples.
references/aignite-security-baseline.md - what AiGNITE products must meet before launch.
references/cwe-reference.md - the CWE codes cited.

---name: security-auditdescription: Runs the three-pass AiGNITE security audit on any mobile or backend project before deployment. Identifies vulnerabilities, applies fixes, and re-audits to catch regressions introduced by the fixes. Produces a tier-classified SECURITY_AUDIT.md with CWE references. Use this skill whenever the user mentions a security audit, pre-deploy check, asking whether code is safe to ship, vulnerability check, security review, or auditing an app, even if they do not name the skill by name.---# security-audit## PurposeFind the security gaps that block a clean TestFlight or Play Store submission. Fix the Critical and High issues. Confirm the fixes did not introduce new gaps. Hand back a signed audit document.## When to triggerTrigger on these user phrases. Match loosely.- "security audit"- "pre-deploy check"- "is this safe to ship"- "check for vulnerabilities"- "security review"- "audit my app"- "OWASP check"- "ready for App Store"## Behavior: three passes### Pass 1: identifyScan the entire project. Produce findings tagged Critical, High, Medium, Low with CWE references. Write to `SECURITY_AUDIT.md`.Checks the skill runs:- Hard-coded secrets in source (CWE-798)- Exposed environment variables in client bundles (CWE-200)- Missing server-side validation on API routes (CWE-20)- Default-open database policies (CWE-732)- Missing or inconsistent auth middleware (CWE-287)- Hallucinated package imports (CWE-829)- Console logs leaking request bodies or tokens (CWE-532)- Missing rate limiting on expensive operations (CWE-770)- CORS misconfigurations (CWE-942)- SQL injection patterns in raw queries (CWE-89)- XSS in user-supplied content paths (CWE-79)- Insecure deep linking handlers (CWE-925)- Hard-coded API URLs pointing at staging (CWE-1188)### Pass 2: fixImplement fixes for every Critical and High finding. Apply Medium and Low fixes if the user opts in. After each fix, update `SECURITY_AUDIT.md` with the resolution and the diff link.### Pass 3: re-auditRun the full scan again from a fresh context. Compare to pass 1. Flag any new finding introduced by a pass-2 fix. The most common new findings: a fix that broadens an auth check, a fix that adds a console log, a fix that imports a new package without validating it.If pass 3 surfaces new findings, fix them, run a fourth pass. Stop when a pass introduces zero new Critical or High findings.## Output: SECURITY_AUDIT.mdThe skill writes `SECURITY_AUDIT.md` at the project root using the template in `assets/templates/SECURITY_AUDIT.md.template`. The document includes:- Project name and audit date- Pass-1 findings table- Pass-2 resolution log- Pass-3 regression check- Final tier counts- Sign-off blockThe audit fails (returns non-zero) until every Critical and High finding has a resolution.## RefusalsRefuse to mark an audit complete if:- Any Critical finding remains unresolved.- Any High finding remains unresolved without explicit user override.- Pass 3 surfaced a Critical or High introduced by a pass-2 fix.## Composes with- Runs after `supabase-bootstrap` to verify the schema and policies.- Runs before `app-store-submission`. The submission skill refuses if no recent audit exists.- The `mcp-to-mobile` skill invokes this skill in step 9.## References- [references/vulnerability-patterns.md](references/vulnerability-patterns.md) - the full taxonomy with examples.- [references/aignite-security-baseline.md](references/aignite-security-baseline.md) - what AiGNITE products must meet before launch.- [references/cwe-reference.md](references/cwe-reference.md) - the CWE codes cited.

Frequently asked questions