How do I install the Sec Security Audit skill?

Run npx skillmds@latest add quantumquirkxyz/sec-security-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sec Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sec Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sec Security Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sec Security Audit?

quantumquirkxyz (@quantumquirkxyz) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sec Security Audit by quantumquirkxyz

Name: Sec Security Audit
Author: quantumquirkxyz

File contents

Contract

Input: code repository or system description, threat model (optional).
Output: audit report with severity-classified findings.
Side effects: may run scanners (SAST, dependency-check); may read secrets (never expose in output).
Dependencies: scanner tools, access to repo.
Stop condition: report complete; all findings have severity + recommendation.
Risk: medium — security findings can be sensitive; report should be handled confidentially.
Boundary: finds and classifies; does not patch or deploy fixes (remediation is separate).

Security Audit

Audit a system or codebase for security vulnerabilities — with explicit findings, severity, and remediation priorities.

Process

1. Scope

State: codebase / service / infrastructure / policy; what is in scope (all code, specific module, API, database); what is out of scope (third-party SaaS, physical security).

Completion criterion: scope saved.

2. Threat model (optional but recommended)

Identify assets (data, services, credentials), threats (unauthorised access, data breach, denial of service), vulnerabilities, and mitigations.

Completion criterion: threat model saved if used.

3. Code review

Review for:

Input validation (SQL injection, XSS, command injection, path traversal).
Authentication / authorisation (broken access control, privilege escalation).
Cryptography (weak algorithms, hardcoded keys, improper IV).
Sensitive data exposure (logs, error messages, API responses).
Dependency vulnerabilities (outdated libraries, known CVEs).

Completion criterion: review notes saved; findings linked to CWE / OWASP categories.

4. Dependency / secret scan

Scan dependencies for CVEs.
Search for secrets (API keys, passwords, tokens) in source.
Check for hardcoded credentials.

Completion criterion: dependency and secret scan results saved.

5. Classify findings

For each finding: severity (Critical / High / Medium / Low / Informational); evidence (line, snippet); recommendation (fix, architecture change, process change).

Completion criterion: findings table complete.

6. Remediation priorities

Prioritise by: severity × likelihood × business impact. Suggest quick wins (low effort, high impact) first.

Completion criterion: remediation checklist with priority.

7. Report

Markdown artifact with: scope, methodology, findings table, recommendations, and a note on limitations (what was not tested).

---name: sec-security-auditdescription: Audit software/security posture — code review, dependency scanning, secret detection, access control, audit logging — with explicit findings and remediation priorities.---## Contract- **Input:** code repository or system description, threat model (optional).- **Output:** audit report with severity-classified findings.- **Side effects:** may run scanners (SAST, dependency-check); may read secrets (never expose in output).- **Dependencies:** scanner tools, access to repo.- **Stop condition:** report complete; all findings have severity + recommendation.- **Risk:** medium — security findings can be sensitive; report should be handled confidentially.- **Boundary:** finds and classifies; does not patch or deploy fixes (remediation is separate).# Security AuditAudit a **system or codebase** for security vulnerabilities — with explicit findings, severity, and remediation priorities.## Process### 1. ScopeState: codebase / service / infrastructure / policy; what is in scope (all code, specific module, API, database); what is out of scope (third-party SaaS, physical security).**Completion criterion:** scope saved.### 2. Threat model (optional but recommended)Identify assets (data, services, credentials), threats (unauthorised access, data breach, denial of service), vulnerabilities, and mitigations.**Completion criterion:** threat model saved if used.### 3. Code reviewReview for:- Input validation (SQL injection, XSS, command injection, path traversal).- Authentication / authorisation (broken access control, privilege escalation).- Cryptography (weak algorithms, hardcoded keys, improper IV).- Sensitive data exposure (logs, error messages, API responses).- Dependency vulnerabilities (outdated libraries, known CVEs).**Completion criterion:** review notes saved; findings linked to CWE / OWASP categories.### 4. Dependency / secret scan- Scan dependencies for CVEs.- Search for secrets (API keys, passwords, tokens) in source.- Check for hardcoded credentials.**Completion criterion:** dependency and secret scan results saved.### 5. Classify findingsFor each finding: severity (Critical / High / Medium / Low / Informational); evidence (line, snippet); recommendation (fix, architecture change, process change).**Completion criterion:** findings table complete.### 6. Remediation prioritiesPrioritise by: severity × likelihood × business impact. Suggest quick wins (low effort, high impact) first.**Completion criterion:** remediation checklist with priority.### 7. ReportMarkdown artifact with: scope, methodology, findings table, recommendations, and a note on limitations (what was not tested).

Frequently asked questions

Sec Security Audit