josstei/security-audit
claude/skills/security-audit/SKILL.md
Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and exploitability risks
$ install --global
skillsauthnpx skillsauth add josstei/maestro-gemini security-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:52 PM1.7s1 file scanned
SKILL.md
- name:
- security-audit
- description:
- Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and exploitability risks
Maestro Security Audit
Call get_skill_content with resources: ["architecture"].
Protocol
Before delegating, call get_skill_content with resources: ["delegation"] and follow the returned methodology.
Workflow
- Define the audit scope from the user request and relevant code paths
- Trace trust boundaries, auth flows, secret handling, and data exposure paths
- Review for exploitable flaws, unsafe defaults, OWASP Top 10 vulnerabilities, and high-risk dependencies
- Classify findings by severity (CVSS-aligned) with file references and exploitability assessment
- Provide remediation guidance with the highest-risk issues first
Constraints
- Prefer actionable findings over generic security advice
- Present findings before proposing remediation
- State clearly when the review is limited by unavailable runtime context
- Do not modify code without explicit user approval
Related Skills
josstei/session-management
tools
VerifiedTrustedCommunity
Manages orchestration session state, tracking, and resumption
388SKILL.mdUpdated Apr 16, 2026
josstei/implementation-planning
data-ai
VerifiedTrustedCommunity
Generates detailed implementation plans from finalized designs
388SKILL.mdUpdated Apr 16, 2026
josstei/execution
tools
VerifiedTrustedCommunity
Phase execution methodology for orchestration workflows with error handling and completion protocols
388SKILL.mdUpdated Apr 16, 2026
josstei/design-dialogue
documentation
VerifiedTrustedCommunity
Guides structured design conversations for complex engineering tasks
388SKILL.mdUpdated Apr 16, 2026