# Security Audit > Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening. - Skill: `techwavedev/security-audit` (Agent Skill) - Install (CLI): `npx skillmds@latest add techwavedev/security-audit` - Raw SKILL.md: https://api.skillmd.com/api/skills/techwavedev/security-audit/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: techwavedev (https://skillmd.com/u/techwavedev) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/techwavedev/security-audit --- # Security Auditing Workflow Bundle ## Overview Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation. ## When to Use This Workflow Use this workflow when: - Performing security audits on web applications - Testing API security - Conducting penetration tests - Scanning for vulnerabilities - Hardening application security - Compliance security assessments ## Workflow Phases ### Phase 1: Reconnaissance #### Skills to Invoke - `scanning-tools` - Security scanning - `shodan-reconnaissance` - Shodan searches - `top-web-vulnerabilities` - OWASP Top 10 #### Actions 1. Identify target scope 2. Gather intelligence 3. Map attack surface 4. Identify technologies 5. Document findings #### Copy-Paste Prompts ``` Use @scanning-tools to perform initial reconnaissance ``` ``` Use @shodan-reconnaissance to find exposed services ``` ### Phase 2: Vulnerability Scanning #### Skills to Invoke - `vulnerability-scanner` - Vulnerability analysis - `security-scanning-security-sast` - Static analysis - `security-scanning-security-dependencies` - Dependency scanning #### Actions 1. Run automated scanners 2. Perform static analysis 3. Scan dependencies 4. Identify misconfigurations 5. Document vulnerabilities #### Copy-Paste Prompts ``` Use @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities ``` ``` Use @security-scanning-security-dependencies to audit dependencies ``` ### Phase 3: Web Application Testing #### Skills to Invoke - `top-web-vulnerabilities` - OWASP vulnerabilities - `sql-injection-testing` - SQL injection - `xss-html-injection` - XSS testing - `broken-authentication` - Authentication testing - `idor-testing` - IDOR testing - `file-path-traversal` - Path traversal - `burp-suite-testing` - Burp Suite testing #### Actions 1. Test for injection flaws 2. Test authentication mechanisms 3. Test session management 4. Test access controls 5. Test input validation 6. Test security headers #### Copy-Paste Prompts ``` Use @sql-injection-testing to test for SQL injection vulnerabilities ``` ``` Use @xss-html-injection to test for cross-site scripting ``` ``` Use @broken-authentication to test authentication security ``` ### Phase 4: API Security Testing #### Skills to Invoke - `api-fuzzing-bug-bounty` - API fuzzing - `api-security-best-practices` - API security #### Actions 1. Enumerate API endpoints 2. Test authentication/authorization 3. Test rate limiting 4. Test input validation 5. Test error handling 6. Document API vulnerabilities #### Copy-Paste Prompts ``` Use @api-fuzzing-bug-bounty to fuzz API endpoints ``` ### Phase 5: Penetration Testing #### Skills to Invoke - `pentest-commands` - Penetration testing commands - `pentest-checklist` - Pentest planning - `ethical-hacking-methodology` - Ethical hacking - `metasploit-framework` - Metasploit #### Actions 1. Plan penetration test 2. Execute attack scenarios 3. Exploit vulnerabilities 4. Document proof of concept 5. Assess impact #### Copy-Paste Prompts ``` Use @pentest-checklist to plan penetration test ``` ``` Use @pentest-commands to execute penetration testing ``` ### Phase 6: Security Hardening #### Skills to Invoke - `security-scanning-security-hardening` - Security hardening - `auth-implementation-patterns` - Authentication - `api-security-best-practices` - API security #### Actions 1. Implement security controls 2. Configure security headers 3. Set up authentication 4. Implement authorization 5. Configure logging 6. Apply patches #### Copy-Paste Prompts ``` Use @security-scanning-security-hardening to harden application security ``` ### Phase 7: Reporting #### Skills to Invoke - `reporting-standards` - Security reporting #### Actions 1. Document findings 2. Assess risk levels 3. Provide remediation steps 4. Create executive summary 5. Generate technical report ## Security Testing Checklist ### OWASP Top 10 - [ ] Injection (SQL, NoSQL, OS, LDAP) - [ ] Broken Authentication - [ ] Sensitive Data Exposure - [ ] XML External Entities (XXE) - [ ] Broken Access Control - [ ] Security Misconfiguration - [ ] Cross-Site Scripting (XSS) - [ ] Insecure Deserialization - [ ] Using Components with Known Vulnerabilities - [ ] Insufficient Logging & Monitoring ### API Security - [ ] Authentication mechanisms - [ ] Authorization checks - [ ] Rate limiting - [ ] Input validation - [ ] Error handling - [ ] Security headers ## Quality Gates - [ ] All planned tests executed - [ ] Vulnerabilities documented - [ ] Proof of concepts captured - [ ] Risk assessments completed - [ ] Remediation steps provided - [ ] Report generated ## Related Workflow Bundles - `development` - Secure development practices - `wordpress` - WordPress security - `cloud-devops` - Cloud security - `testing-qa` - Security testing --- ## AGI Framework Integration > **Adapted for [@techwavedev/agi-agent-kit](https://www.npmjs.com/package/@techwavedev/agi-agent-kit)** > Original source: [antigravity-awesome-skills](https://github.com/sickn33/antigravity-awesome-skills) ### Memory-First Protocol Cache workflow configurations and automation patterns. Retrieve prior pipeline designs to avoid re-building similar flows from scratch. ```bash # Check for prior workflow/automation context before starting python3 execution/memory_manager.py auto --query "automation patterns and workflow configurations for Security Audit" ``` ### Storing Results After completing work, store workflow/automation decisions for future sessions: ```bash python3 execution/memory_manager.py store \ --content "Workflow: automated data pipeline with retry logic, dead-letter queue, and Slack alerts on failure" \ --type technical --project \ --tags security-audit workflow ``` ### Multi-Agent Collaboration Share workflow state with other agents so they can trigger, monitor, or extend the automation. ```bash python3 execution/cross_agent_context.py store \ --agent "" \ --action "Workflow automation deployed — pipeline processing 1000+ events/day with 99.9% success rate" \ --project ``` ### Playbook Engine Combine this skill with others using the Playbook Engine (`execution/workflow_engine.py`) for guided multi-step automation with progress tracking.