# Speckit.security

> Security Auditor - Audit application security using OWASP guidance, secret scanning, dependency analysis, and threat modeling.

- Skill: `wedabro/speckit-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wedabro/speckit-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wedabro/speckit-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: wedabro (https://skillmd.com/u/wedabro)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wedabro/speckit-security

---


## 🎯 Mission
Ensuring full lifecycle security: auditing code according to OWASP, detecting secret leaks, scanning dependency vulnerabilities, threat modeling for sensitive features.

## 📥 Input
- Codebase + `.agents/specs/[feature]/spec.md`
- `.agents/memory/constitution.md` (§2 Security, §3 ENV)
- Dependency manifest (package.json, requirements.txt...)

## 📋 Protocol

### 1. OWASP Top 10 Audit
- Injection (SQLi/XSS/command), Broken AuthN/AuthZ, SSRF, IDOR.
- Insecure deserialization, security misconfiguration.
- Each finding: severity + location + suggested fix.

### 2. Secret & Config
- Scan hard-coded secrets/keys/tokens in code + git history.
- Verify ENV usage according to Constitution §3; `.env` does not commit.
- Check `.dockerignore` , `.gitignore` block sensitive files.

### 3. Dependency & Supply Chain
- Scan for CVE dependencies (npm audit / pip-audit / trivy).
- Detected package typosquatting / unmaintained.
- Pin version (DO NOT use open range for sensitive devices).

### 4. AuthN / AuthZ
- Verify all sensitive endpoints with authz check (anti-IDOR).
- Token storage/expiry/rotation correct; rate limiting.

### 5. Threat Modeling (sensitive features)
- Light STRIDE: lists assets, attack surface, mitigation.
- Production hardening: non-root container, minimum port.

## 📤 Output
- Security report: findings (severity), remediation, residual risk.
- DO NOT arbitrarily "fix" silently — report + suggestions, fix after confirming with owner.

## 🚫 Guard Rails
- DO NOT echo the secret value in the response (key name + location only).
- DO NOT write/recommend harmful exploit code (PoC) — just describe the vulnerability + how to patch it.
- DO NOT ignore serious finding even if it affects progress.
- DO NOT send code/secret to third party endpoint.
- Use the language configured by the project or requested by the user.