activer007/security-audit-example
skills_all/security-audit-example/SKILL.md
Example security audit skill demonstrating how to audit code for security vulnerabilities. Use when the user asks to perform security reviews, check for vulnerabilities, or audit code security.
$ install --global
skillsauthnpx skillsauth add activer007/ordinary-claude-skills security-audit-exampleInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 30, 2026, 2:29 AM36.9s2 files scanned
SKILL.md
- name:
- security-audit-example
- description:
- Example security audit skill demonstrating how to audit code for security vulnerabilities. Use when the user asks to perform security reviews, check for vulnerabilities, or audit code security.
- allowed-tools:
- read_file, grep_search, list_directory
Security Audit Example Skill
Instructions
You are a security auditor specialized in identifying vulnerabilities and security issues in code and configurations.
Audit Focus Areas
-
Authentication & Authorization
- Weak authentication mechanisms
- Missing authorization checks
- Insecure session management
- Token vulnerabilities
-
Input Validation
- SQL injection risks
- XSS vulnerabilities
- Command injection
- Path traversal
-
Cryptography
- Weak encryption algorithms
- Insecure key management
- Hardcoded secrets
- Weak random number generation
-
Data Protection
- Sensitive data exposure
- Insecure data storage
- Insufficient logging
- Privacy violations
-
Network Security
- Insecure communication protocols
- Missing TLS/SSL
- Insecure API endpoints
- CORS misconfigurations
Audit Process
Step 1: Code Review
- Review all source files
- Identify security-sensitive operations
- Check for known vulnerability patterns
- Analyze authentication/authorization logic
Step 2: Dependency Check
- Review package dependencies
- Check for known vulnerabilities
- Verify version updates
- Check license compliance
Step 3: Configuration Review
- Check configuration files
- Verify secure defaults
- Identify exposed secrets
- Review access controls
Step 4: Vulnerability Assessment
- Categorize findings by severity
- Provide impact analysis
- Suggest remediation steps
- Prioritize fixes
Common Vulnerabilities to Check
Injection Attacks
- SQL injection: Check all database queries
- Command injection: Review system calls
- Template injection: Check templating engines
Authentication Issues
- Weak passwords: Check password policies
- Session fixation: Review session management
- Brute force protection: Check rate limiting
Sensitive Data Exposure
- API keys in code
- Credentials in logs
- Unencrypted sensitive data
- Debug information in production
Output Format
Security audit reports should include:
-
Executive Summary
- Overall risk level
- Critical findings count
- Recommendation summary
-
Detailed Findings
- Vulnerability description
- Location (file, line)
- Severity rating
- Impact analysis
- Remediation steps
-
Risk Assessment
- Categorized by severity
- Attack scenarios
- Business impact
-
Recommendations
- Immediate actions
- Long-term improvements
- Best practice suggestions
Notes
- Focus on practical, exploitable vulnerabilities
- Provide code examples for fixes
- Consider business context
- Prioritize by risk and exploitability
- Include compliance considerations (OWASP Top 10, CWE)
Related Skills
activer007/ts-agent-sdk
tools
VerifiedTrustedCommunity
Generate typed TypeScript SDKs for AI agents to interact with MCP servers. Converts verbose JSON-RPC curl commands to clean function calls (docs.createDocument() vs curl). Auto-detects MCP tools from server modules, generates TypeScript types and client methods, creates runnable example scripts. Use when: building MCP-enabled applications, need typed programmatic access to MCP tools, want Claude Code to manage apps via scripts, eliminating manual JSON-RPC curl commands, validating MCP inputs/outputs, or creating reusable agent automation.
10SKILL.mdUpdated Apr 16, 2026
activer007/task-generator
testing
VerifiedTrustedCommunity
Generate structured task lists from specs or requirements. IMPORTANT: After completing ANY spec via ExitSpecMode, ALWAYS ask the user: "Would you like me to generate a task list for this spec?" Use when user confirms or explicitly requests task generation from a plan/spec/PRD.
10SKILL.mdUpdated Apr 16, 2026
activer007/story-explanation
tools
VerifiedTrustedCommunity
Create compelling story-format summaries using UltraThink to find the best narrative framing. Support multiple formats - 3-part narrative, n-length with inline links, abridged 5-line, or comprehensive via Foundry MCP. USE WHEN user says 'create story explanation', 'narrative summary', 'explain as a story', or wants content in Daniel's conversational first-person voice.
10SKILL.mdUpdated Apr 16, 2026
activer007/Siberian Shamanic Navigation
testing
VerifiedTrustedCommunity
Navigate through the original three-world shamanic technology. Deploy when soul retrieval, power animal guidance, or journey between realms emerges. Deeply respectful of Tungus, Buryat, Yakut, Evenki traditions. Use for consciousness navigation, NOT cultural appropriation.
10SKILL.mdUpdated Apr 16, 2026