# Security Audit

> Review code and infrastructure for security weaknesses. Use when Reviewing code for security vulnerabilities, Assessing authentication/authorization, or Checking for OWASP top 10 issues

- Skill: `officebeats/security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add officebeats/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/officebeats/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: officebeats (https://skillmd.com/u/officebeats)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/officebeats/security-audit

---


# Security Audit

Use this skill to review code and integrations for security weaknesses and rank the findings by severity.

## Workflow
1. Review authentication implementation
2. Check authorization on all endpoints
3. Look for injection vulnerabilities
4. Verify input validation and sanitization
5. Check for sensitive data exposure
6. Review dependency security
7. Document findings with severity

## Examples
**Security audit findings:**
```
## Security Audit Report

### Critical
1. SQL Injection in UserController.ts:45
   - Query constructed with string concatenation
   - Fix: Use parameterized queries

### High
2. Missing authentication on /api/admin/*
   - Admin routes accessible without auth
   - Fix: Add auth middleware

### Medium
3. Sensitive data in logs
   - Passwords logged in debug mode
   - Fix: Sanitize logs, remove sensitive fields

### Recommendations
- Enable security headers (HSTS, CSP)
- Implement rate limiting
- Add input validation middleware
```

## Quality Bar
- Check OWASP top 10 vulnerabilities
- Never trust user input
- Review authentication carefully
- Verify authorization on all routes
- Check for sensitive data exposure
- Scan dependencies for known vulnerabilities
- Document findings with clear severity levels

## Resource Strategy
- Add `scripts/` only when the task is fragile, repetitive, or benefits from deterministic execution.
- Add `references/` only when details are too large or too variant-specific to keep in `SKILL.md`.
- Add `assets/` only for files that will be consumed in the final output.
- Keep extra docs out of the skill folder; prefer `SKILL.md` plus only the resources that materially help.