ranbot-ai/security-audit
skills/security-audit/SKILL.md
Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
$ install --global
skillsauthnpx skillsauth add ranbot-ai/awesome-skills security-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 2, 2026, 6:00 AM217.9s1 file scanned
SKILL.md
- name:
- security-audit
- description:
- Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
- category:
- Security & Systems
- source:
- antigravity
- tags:
- [api, ai, workflow, document, security, pentest, hacking, vulnerability, aws, cro]
- url:
- https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security-audit
Security Auditing Workflow Bundle
Overview
Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation.
When to Use This Workflow
Use this workflow when:
- Performing security audits on web applications
- Testing API security
- Conducting penetration tests
- Scanning for vulnerabilities
- Hardening application security
- Compliance security assessments
Workflow Phases
Phase 1: Reconnaissance
Skills to Invoke
scanning-tools- Security scanningshodan-reconnaissance- Shodan searchestop-web-vulnerabilities- OWASP Top 10
Actions
- Identify target scope
- Gather intelligence
- Map attack surface
- Identify technologies
- Document findings
Copy-Paste Prompts
Use @scanning-tools to perform initial reconnaissance
Use @shodan-reconnaissance to find exposed services
Phase 2: Vulnerability Scanning
Skills to Invoke
vulnerability-scanner- Vulnerability analysissecurity-scanning-security-sast- Static analysissecurity-scanning-security-dependencies- Dependency scanning
Actions
- Run automated scanners
- Perform static analysis
- Scan dependencies
- Identify misconfigurations
- Document vulnerabilities
Copy-Paste Prompts
Use @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities
Use @security-scanning-security-dependencies to audit dependencies
Phase 3: Web Application Testing
Skills to Invoke
top-web-vulnerabilities- OWASP vulnerabilitiessql-injection-testing- SQL injectionxss-html-injection- XSS testingbroken-authentication- Authentication testingidor-testing- IDOR testingfile-path-traversal- Path traversalburp-suite-testing- Burp Suite testing
Actions
- Test for injection flaws
- Test authentication mechanisms
- Test session management
- Test access controls
- Test input validation
- Test security headers
Copy-Paste Prompts
Use @sql-injection-testing to test for SQL injection vulnerabilities
Use @xss-html-injection to test for cross-site scripting
Use @broken-authentication to test authentication security
Phase 4: API Security Testing
Skills to Invoke
api-fuzzing-bug-bounty- API fuzzingapi-security-best-practices- API security
Actions
- Enumerate API endpoints
- Test authentication/authorization
- Test rate limiting
- Test input validation
- Test error handling
- Document API vulnerabilities
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to fuzz API endpoints
Phase 5: Penetration Testing
Skills to Invoke
pentest-commands- Penetration testing commandspentest-checklist- Pentest planningethical-hacking-methodology- Ethical hackingmetasploit-framework- Metasploit
Actions
- Plan penetration test
- Execute attack scenarios
- Exploit vulnerabilities
- Document proof of concept
- Assess impact
Copy-Paste Prompts
Use @pentest-checklist to plan penetration test
Use @pentest-commands to execute penetration testing
Phase 6: Security Hardening
Skills to Invoke
security-scanning-security-hardening- Security hardeningauth-implementation-patterns- Authenticationapi-security-best-practices- API security
Actions
- Implement security controls
- Configure security headers
- Set up authentication
- Implement authorization
- Configure logging
- Apply patches
Copy-Paste Prompts
Use @security-scanning-security-hardening to harden application security
Phase 7: Reporting
Skills to Invoke
reporting-standards- Security reporting
Actions
- Document findings
- Assess risk levels
- Provide remediation steps
- Create executive summary
- Generate technical report
Security Testing Checklist
OWASP Top 10
- [ ] Injection (SQL, NoSQL, OS, LDAP)
- [ ] Broken Authentication
- [ ] Sensitive Data Exposure
- [ ] XML External Entities (XXE)
- [ ] Broken Access Control
- [ ] Security Misconfiguration
- [ ] Cross-Site Scripting (XSS)
- [ ] Insecure Deserialization
- [ ] Using Components with Known Vulnerabilities
- [ ] Insufficient Logging & Monitoring
API Security
- [ ] Authentication mechanisms
- [ ] Authorization checks
- [ ] Rate limiting
- [ ] Input validation
- [ ] Error handling
- [ ] Security headers
Quality Gates
- [ ] All planned tests executed
- [ ] Vulnerabilities documented
- [ ] Proof of concepts captured
- [ ] Risk assessments completed
- [ ] Remediation steps provided
- [ ] Report generated
Related Workflow Bundles
development- Secure development practiceswordpress- WordPress securitycloud-devops- Cloud securitytesting-qa- Security testing
Related Skills
ranbot-ai/nextjs-seo-indexing
testing
VerifiedTrustedCommunity
Fix SEO indexing issues, crawl budget problems, and Search Console coverage errors for Next.js apps. Covers canonical tags, noindex audits, sitemap health, static rendering, and internal linking.
5SKILL.mdUpdated Jun 2, 2026
ranbot-ai/moatmri
data-ai
VerifiedTrustedCommunity
Analyze AI disruption pressure across a business, map competitive exposure, and produce a 90-day defensive action plan.
5SKILL.mdUpdated Jun 2, 2026
ranbot-ai/skills/longbridge
tools
VerifiedTrustedCommunity
--- name: longbridge description: 125+ agent skills for Longbridge Securities — real-time quotes, charts, fundamentals, portfolio analysis, options, and more for HK/US/A-share/SG markets. Trilingual: Simplified Chinese, Traditional category: AI & Agents source: antigravity tags: [api, mcp, claude, ai, agent, security, cro] url: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/longbridge --- # Longbridge ## Overview Longbridge is the official skill collection for Longbr
5SKILL.mdUpdated Jun 2, 2026
ranbot-ai/github-actions-advanced
tools
VerifiedTrustedCommunity
Design, debug, and harden GitHub Actions CI/CD workflows, including reusable workflows, matrix builds, self-hosted runners, OIDC authentication, caching, environments, secrets, and release automation.
5SKILL.mdUpdated Jun 2, 2026