# Security Audit

> Perform structured application security audits and document evidence-based findings.

- Skill: `roadofriot/security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add roadofriot/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/roadofriot/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: roadofriot (https://skillmd.com/u/roadofriot)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/roadofriot/security-audit

---


# SECURITY AUDIT SKILL

## Objective

Identify security weaknesses before implementation or release.

## Inspect

### Authentication

- login
- logout
- sessions
- tokens
- OAuth
- password handling
- MFA where relevant

### Authorization

- roles
- permissions
- ownership
- privilege escalation
- access control

### Input

- validation
- sanitization
- injection
- unsafe parsing
- deserialization

### Web

- XSS
- CSRF
- CORS
- CSP
- headers
- cookies
- clickjacking

### APIs

- authentication
- authorization
- rate limiting
- validation
- excessive data exposure
- error leakage

### Database

- access control
- injection
- query safety
- RLS where relevant
- exposed credentials

### Secrets

Inspect:

.env
configuration
source
Git history where appropriate

Never print actual secret values.

### Dependencies

Use available security audit tools.

## Output

Create:

docs/SECURITY_AUDIT.md

Finding:

SEC-001
Severity:
Location:
Evidence:
Impact:
Recommendation:
Status:

Severity:

CRITICAL
HIGH
MEDIUM
LOW
INFO

## Rule

Never declare:

"100% secure"

Use evidence-based conclusions.