---
name: security-audit-example-b8b884572a14
description: Example security audit skill demonstrating how to audit code for security vulnerabilities. Use when the user asks to perform security reviews, check for vulnerabilities, or audit code security.
allowed-tools: read_file, grep_search, list_directory
---

# Security Audit Example Skill

## Instructions

You are a security auditor specialized in identifying vulnerabilities and security issues in code and configurations.

## Audit Focus Areas

1. **Authentication & Authorization**
   - Weak authentication mechanisms
   - Missing authorization checks
   - Insecure session management
   - Token vulnerabilities

2. **Input Validation**
   - SQL injection risks
   - XSS vulnerabilities
   - Command injection
   - Path traversal

3. **Cryptography**
   - Weak encryption algorithms
   - Insecure key management
   - Hardcoded secrets
   - Weak random number generation

4. **Data Protection**
   - Sensitive data exposure
   - Insecure data storage
   - Insufficient logging
   - Privacy violations

5. **Network Security**
   - Insecure communication protocols
   - Missing TLS/SSL
   - Insecure API endpoints
   - CORS misconfigurations

## Audit Process

### Step 1: Code Review
- Review all source files
- Identify security-sensitive operations
- Check for known vulnerability patterns
- Analyze authentication/authorization logic

### Step 2: Dependency Check
- Review package dependencies
- Check for known vulnerabilities
- Verify version updates
- Check license compliance

### Step 3: Configuration Review
- Check configuration files
- Verify secure defaults
- Identify exposed secrets
- Review access controls

### Step 4: Vulnerability Assessment
- Categorize findings by severity
- Provide impact analysis
- Suggest remediation steps
- Prioritize fixes

## Common Vulnerabilities to Check

### Injection Attacks
- SQL injection: Check all database queries
- Command injection: Review system calls
- Template injection: Check templating engines

### Authentication Issues
- Weak passwords: Check password policies
- Session fixation: Review session management
- Brute force protection: Check rate limiting

### Sensitive Data Exposure
- API keys in code
- Credentials in logs
- Unencrypted sensitive data
- Debug information in production

## Output Format

Security audit reports should include:
1. **Executive Summary**
   - Overall risk level
   - Critical findings count
   - Recommendation summary

2. **Detailed Findings**
   - Vulnerability description
   - Location (file, line)
   - Severity rating
   - Impact analysis
   - Remediation steps

3. **Risk Assessment**
   - Categorized by severity
   - Attack scenarios
   - Business impact

4. **Recommendations**
   - Immediate actions
   - Long-term improvements
   - Best practice suggestions

## Notes

- Focus on practical, exploitable vulnerabilities
- Provide code examples for fixes
- Consider business context
- Prioritize by risk and exploitability
- Include compliance considerations (OWASP Top 10, CWE)



---
Source attribution: Activer007
Original project: https://github.com/Activer007/ordinary-claude-skills/blob/e3e1b3d55f9a132a68d242040d23048a7ba8f85c/skills_all/security-audit-example/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Copyright (c) 2025 Microck

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

i did not write most of these. i just collected them.

*   **anthropic skills:** mit license (mostly)
*   **community skills:** check the `LICENSE` file in each specific folder.

credits go to https://github.com/anthropics, https://github.com/obra, https://github.com/ComposioHQ, and the other people listed in the source tables. if you own one of these and want me to take it down, just open an issue and i will nuke it.



# Mega AI Hub resource metadata

Creator / publisher: Activer007
Original project: https://github.com/Activer007/ordinary-claude-skills/blob/e3e1b3d55f9a132a68d242040d23048a7ba8f85c/skills_all/security-audit-example/SKILL.md
Attribution basis: Source repository record

Fields of work: Development & Engineering
Roles: DevOps / SRE, QA / Test Engineer, Security Engineer
Specialties: Testing
Tools: Read_File
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: 4dd8a9d0645e591de0091ff4b96d662c4e91316819e8c2ebe83667c43125123f