--- name: security-audit-397532297072 description: "Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening." category: workflow-bundle risk: safe source: personal date_added: "2026-02-27" --- # Security Auditing Workflow Bundle ## Overview Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation. ## When to Use This Workflow Use this workflow when: - Performing security audits on web applications - Testing API security - Conducting penetration tests - Scanning for vulnerabilities - Hardening application security - Compliance security assessments ## Workflow Phases ### Phase 1: Reconnaissance #### Skills to Invoke - `scanning-tools` - Security scanning - `shodan-reconnaissance` - Shodan searches - `top-web-vulnerabilities` - OWASP Top 10 #### Actions 1. Identify target scope 2. Gather intelligence 3. Map attack surface 4. Identify technologies 5. Document findings #### Copy-Paste Prompts ``` Use @scanning-tools to perform initial reconnaissance ``` ``` Use @shodan-reconnaissance to find exposed services ``` ### Phase 2: Vulnerability Scanning #### Skills to Invoke - `vulnerability-scanner` - Vulnerability analysis - `security-scanning-security-sast` - Static analysis - `security-scanning-security-dependencies` - Dependency scanning #### Actions 1. Run automated scanners 2. Perform static analysis 3. Scan dependencies 4. Identify misconfigurations 5. Document vulnerabilities #### Copy-Paste Prompts ``` Use @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities ``` ``` Use @security-scanning-security-dependencies to audit dependencies ``` ### Phase 3: Web Application Testing #### Skills to Invoke - `top-web-vulnerabilities` - OWASP vulnerabilities - `sql-injection-testing` - SQL injection - `xss-html-injection` - XSS testing - `broken-authentication` - Authentication testing - `idor-testing` - IDOR testing - `file-path-traversal` - Path traversal - `burp-suite-testing` - Burp Suite testing #### Actions 1. Test for injection flaws 2. Test authentication mechanisms 3. Test session management 4. Test access controls 5. Test input validation 6. Test security headers #### Copy-Paste Prompts ``` Use @sql-injection-testing to test for SQL injection vulnerabilities ``` ``` Use @xss-html-injection to test for cross-site scripting ``` ``` Use @broken-authentication to test authentication security ``` ### Phase 4: API Security Testing #### Skills to Invoke - `api-fuzzing-bug-bounty` - API fuzzing - `api-security-best-practices` - API security #### Actions 1. Enumerate API endpoints 2. Test authentication/authorization 3. Test rate limiting 4. Test input validation 5. Test error handling 6. Document API vulnerabilities #### Copy-Paste Prompts ``` Use @api-fuzzing-bug-bounty to fuzz API endpoints ``` ### Phase 5: Penetration Testing #### Skills to Invoke - `pentest-commands` - Penetration testing commands - `pentest-checklist` - Pentest planning - `ethical-hacking-methodology` - Ethical hacking - `metasploit-framework` - Metasploit #### Actions 1. Plan penetration test 2. Execute attack scenarios 3. Exploit vulnerabilities 4. Document proof of concept 5. Assess impact #### Copy-Paste Prompts ``` Use @pentest-checklist to plan penetration test ``` ``` Use @pentest-commands to execute penetration testing ``` ### Phase 6: Security Hardening #### Skills to Invoke - `security-scanning-security-hardening` - Security hardening - `auth-implementation-patterns` - Authentication - `api-security-best-practices` - API security #### Actions 1. Implement security controls 2. Configure security headers 3. Set up authentication 4. Implement authorization 5. Configure logging 6. Apply patches #### Copy-Paste Prompts ``` Use @security-scanning-security-hardening to harden application security ``` ### Phase 7: Reporting #### Skills to Invoke - `reporting-standards` - Security reporting #### Actions 1. Document findings 2. Assess risk levels 3. Provide remediation steps 4. Create executive summary 5. Generate technical report ## Security Testing Checklist ### OWASP Top 10 - [ ] Injection (SQL, NoSQL, OS, LDAP) - [ ] Broken Authentication - [ ] Sensitive Data Exposure - [ ] XML External Entities (XXE) - [ ] Broken Access Control - [ ] Security Misconfiguration - [ ] Cross-Site Scripting (XSS) - [ ] Insecure Deserialization - [ ] Using Components with Known Vulnerabilities - [ ] Insufficient Logging & Monitoring ### API Security - [ ] Authentication mechanisms - [ ] Authorization checks - [ ] Rate limiting - [ ] Input validation - [ ] Error handling - [ ] Security headers ## Quality Gates - [ ] All planned tests executed - [ ] Vulnerabilities documented - [ ] Proof of concepts captured - [ ] Risk assessments completed - [ ] Remediation steps provided - [ ] Report generated ## Related Workflow Bundles - `development` - Secure development practices - `wordpress` - WordPress security - `cloud-devops` - Cloud security - `testing-qa` - Security testing ## Limitations - Use this skill only when the task clearly matches the scope described above. - Do not treat the output as a substitute for environment-specific validation, testing, or expert review. - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing. --- Source attribution: ASoudy Original project: https://github.com/ASoudy/AGS/blob/cd1d94757d590093507ef8ac26299eab8bc20478/AGAS/plugins/antigravity-awesome-skills-claude/skills/security-audit/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 Antigravity User Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: ASoudy Original project: https://github.com/ASoudy/AGS/blob/cd1d94757d590093507ef8ac26299eab8bc20478/AGAS/plugins/antigravity-awesome-skills-claude/skills/security-audit/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Product Management Roles: Data Engineer, DevOps / SRE, QA / Test Engineer, Security Engineer, Technical Product Manager Specialties: API, Testing Tools: Burp Suite, Metasploit, Shodan Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: c33ada466cf7d3dab33ba91d779b30116bef37d9e0e663081301489e14d3b373