# Security Auditor

> Use when working with an advanced security auditing skill focusing on project-specific vulnerabilities, dependency risks, and CSP misconfigurations.

- Skill: `tomevault-io/security-auditor-4` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/security-auditor-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-auditor-4/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/security-auditor-4

---


# Security Auditor Skill (Extended)

This skill provides a framework for conducting security audits, focusing on risks specific to game engines and web applications.

## Audit Scope

1.  **Content Security Policy (CSP)**:
    - Verify removal of `unsafe-inline` and `unsafe-eval`.
    - Check that `wasm-unsafe-eval` is only used where strictly necessary (e.g., specific game engine adapters).
2.  **Dependency Vulnerabilities**:
    - Run `pnpm audit` regularly.
    - Review `npm` package overrides or resolutions.
3.  **Wasm Security**:
    - Validate the source and integrity of `.wasm` binaries.
    - Ensure isolation (e.g., running untrusted Wasm in a sandboxed Worker or iframe).
4.  **Input Validation**:
    - Sanitize all user inputs, especially those passed to game engines (FEN strings, moves).
5.  **Headers**:
    - Check for security headers: `X-Frame-Options`, `X-Content-Type-Options`, `Strict-Transport-Security`, `COOP`, `COEP`.

## Routine Checks

- [ ] **CSP Review**: Are directives as strict as possible?
- [ ] **Dependencies**: Are all critical security updates applied?
- [ ] **Secrets**: Scan for accidentally committed secrets (`.env` files, keys) using `git-secrets` or similar.
- [ ] **Cross-Origin Isolation**: Is the site properly isolated to allow `SharedArrayBuffer` usage if needed for Wasm threads?

## Remediation

- **CSP Violation**: Identify the source script/style. Move inline code to external files or use a nonce/hash.
- **Vulnerable Package**: explicit `pnpm update <package>` or use `pnpm.overrides` in `package.json` to force a secure version.

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/hdkz-dev) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-15 -->