# Security Audit > Perform a security audit of the codebase. Checks for OWASP Top 10, AI-specific vulnerabilities, dependency issues, and configuration problems. Use when this capability is needed. - Skill: `tomevault-io/security-audit-17` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/security-audit-17` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-audit-17/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/security-audit-17 --- # Security Audit Perform a security audit with the following scope: $ARGUMENTS ## Audit Methodology ### 1. Dependency Security Check for known vulnerabilities in dependencies using the package manager's audit command. ### 2. Source Code Analysis Scan for common vulnerability patterns: - Hardcoded secrets (API keys, passwords, tokens) - Command injection via string interpolation in shell/exec calls - XSS vectors in templates - Prompt injection in AI agent inputs - Insecure deserialization - Information disclosure in error messages ### 3. AI Agent Security Review AI agent patterns and verify: - Input sanitization is applied before LLM processing - Output sanitization prevents data leakage - Tool calls are validated and scoped - Prompt injection defenses are in place ### 4. Configuration Security - No secrets in version control - Proper .gitignore coverage - CORS configuration - Environment variable handling ## Output Produce a security report with findings classified by severity: - 🔴 Critical / 🟠 High / 🟡 Medium / 🔵 Low Each finding includes: location, vulnerability, impact, and remediation steps. --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/yu-iskw) — claim your Tome and manage your conversions.