# Security Audit

> Audit code changes for common vulnerabilities — injection, XSS, auth gaps, and secret exposure.

- Skill: `skillist-io/security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add skillist-io/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/skillist-io/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: skillist-io (https://skillmd.com/u/skillist-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/skillist-io/security-audit

---


# Security Audit

Use when reviewing PRs, auth flows, or user-input handling for security issues.

## When to activate

- Pre-merge security review
- New auth or payment integration
- User reports suspicious behavior

## Procedure

1. Trace all user-controlled input to sinks (SQL, shell, HTML, redirects).
2. Verify auth checks on every mutating endpoint.
3. Check for hardcoded secrets and overly broad CORS.
4. Flag missing rate limits on sensitive actions.
5. Map findings to OWASP categories when applicable.

## Output format

| Severity | Location | Issue | Remediation |
|----------|----------|-------|-------------|