hoangnguyen0403/common-security-audit
skills/common/common-security-audit/SKILL.md
Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue), and mobile (iOS, Android, Flutter) codebases. Use when performing security audits, vulnerability scans, secrets detection, or penetration testing.
$ install --global
skillsauthnpx skillsauth add hoangnguyen0403/agent-skills-standard common-security-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 15, 2026, 3:26 AM116.0s8 files scanned
SKILL.md
- name:
- common-security-audit
- description:
- Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue), and mobile (iOS, Android, Flutter) codebases. Use when performing security audits, vulnerability scans, secrets detection, or penetration testing.
Security Audit
Priority: P0 (CRITICAL)
1. Scan for Hardcoded Secrets
See implementation examples for secrets scanning commands.
Covers: Backend source, frontend bundles (REACT_APP_, NEXT_PUBLIC_, VITE_), mobile configs (BuildConfig, iOS configurations, strings.xml).
2. Detect Data Leakage in Logs
See implementation examples for log leakage scanning commands across Node, Go, Dart, Java, Swift.
3. Map Injection Surfaces & Auth Coverage
See implementation examples for injection detection and auth coverage measurement.
4. Run Dependency CVE Scans
- Node/Python/Rust:
npm audit --audit-level=high|pip-audit|cargo audit - Go/Dart:
go list -m -u all|dart pub outdated --json - Java/Mobile:
mvn dependency:list/./gradlew dependencies|pod audit/ Gradle scan
5. Infrastructure & Adversarial Entry Points
See implementation examples for RCE/SSRF/Path Traversal and infrastructure hardening (Docker/K8s).
6. Frontend-Specific Audit
- Exposed Secrets:
grep -rE "(REACT_APP_|NEXT_PUBLIC_|VITE_)" . --include="*.ts*" --include="*.env*" - DOM Sinks & Source Maps: Check
dangerouslySetInnerHTML,innerHTML,eval, and.mapfiles in prod builds.
7. Mobile-Specific Audit
See mobile audit commands for insecure storage (credential stores/Keystore), cert pinning, debug flags, and deep links.
8. Business Logic & Advanced Attacks
- BOLA/IDOR: Verify entity lookups always enforce tenant/owner ownership checks (e.g. any
findByIdwithout anownerfilter is a P0 IDOR vulnerability). - JWT / Mass Assignment: Check missing
exp, weak keys, and uncontrolled property spread (...req.body). - Race / GraphQL: Verify atomic DB transactions, introspection disabled, and query depth limits.
Scoring Impact
| Finding | Threshold | Severity | Deduction | | --- | --- | --- | --- | | Hardcoded Secrets | Any match | P0 | -25 | | Plain-text PII in Logs | Any match | P0 | -20 | | Unguarded Routes > 20% | > 0.2 | P0 | -15 | | Raw SQL Concatenation | Any match | P1 | -10 | | Response Leakage (Stack) | > 0 | P1 | -10 | | Insecure Mobile Storage | Token in plaintext | P1 | -15 | | Missing Cert Pinning | No pinning detected | P2 | -8 | | DOM XSS Sinks | Any match | P1 | -10 |
CAUTION: P0 finding immediately caps Security score at 40/100. Immediate actions for leaked secrets: rotate the credential NOW and purge from history.
Anti-Patterns
- No applying generic patterns over project-specific rules: Respect existing security constraints.
- No ignoring error handling or edge cases: Audit must cover boundary conditions.
- No backend-only audit: Always check frontend AND mobile when in-scope.
References
- Vulnerability Remediation Protocols
- Mobile Audit Commands
Canonical response anchors
When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:
- -25
Related Skills
hoangnguyen0403/common-operator-profile
testing
VerifiedTrustedCommunity
Infer the requesting operator's technical fluency from message content (never ask directly) and adapt register — business, hybrid, or technical — across SDLC workflow output. Use when starting sdlc, brainstorm-feature, plan-feature, verify-work, publish-notes, or session-report, or whenever a request's phrasing signals a non-technical or cross-stack operator.
524SKILL.mdUpdated Jul 12, 2026
hoangnguyen0403/database-transactions
documentation
VerifiedTrustedCommunity
Define transaction boundaries, locking, and consistency guarantees for multi-step writes. Use when designing atomic operations, retries, idempotency, or concurrent write behavior.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-schema-design
development
VerifiedTrustedCommunity
Design relational or document schemas from access patterns, cardinality, and lifecycle. Use when modeling entities, choosing embed vs normalize, or shaping schema boundaries before implementation.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-query-performance
data-ai
VerifiedTrustedCommunity
Diagnose database latency with explain plans, index ownership, and query-shape review. Use when a query is slow, an index is missing, or scans and N+1 patterns appear.
524SKILL.mdUpdated Jun 19, 2026