Common Security Audit Agent Skill

Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue), and mobile (iOS, Android, Flutter) codebases. Use when performing security audits, vulnerability scans, secrets detection, or penetration testing.

5k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

536

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/HoangNguyen0403/agent-skills-standard --skill common-security-audit

What comes with it

17 210 bytes besides the instruction

references/REMEDIATION.md

references/implementation.md

references/mobile-audit.md

references/signals.md

references/trust-review-policy.md

references/vibe-security-scan.md

The instruction itself

14 sections, as written by the author

Security Audit

Priority: P0 (CRITICAL)

1. Scan for Hardcoded Secrets

See implementation examples for secrets scanning commands.

Covers: Backend source, frontend bundles (REACT_APP_, NEXT_PUBLIC_, VITE_), mobile configs (BuildConfig, iOS configurations, strings.xml).

2. Detect Data Leakage in Logs

See implementation examples for log leakage scanning commands across Node, Go, Dart, Java, Swift.

3. Map Injection Surfaces & Auth Coverage

See implementation examples for injection detection and auth coverage measurement.

4. Run Dependency CVE Scans

Node/Python/Rust: npm audit --audit-level=high | pip-audit | cargo audit
Go/Dart: go list -m -u all | dart pub outdated --json
Java/Mobile: mvn dependency:list / ./gradlew dependencies | pod audit / Gradle scan

5. Infrastructure & Adversarial Entry Points

See implementation examples for RCE/SSRF/Path Traversal and infrastructure hardening (Docker/K8s).

6. Frontend-Specific Audit

Exposed Secrets: grep -rE "(REACT_APP_|NEXT_PUBLIC_|VITE_)" . --include="*.ts*" --include="*.env*"
DOM Sinks & Source Maps: Check dangerouslySetInnerHTML, innerHTML, eval, and .map files in prod builds.

7. Mobile-Specific Audit

See mobile audit commands for insecure storage (credential stores/Keystore), cert pinning, debug flags, and deep links.

8. Business Logic & Advanced Attacks

BOLA/IDOR: Verify entity lookups always enforce tenant/owner ownership checks (e.g. any findById without an owner filter is a P0 IDOR vulnerability).
JWT / Mass Assignment: Check missing exp, weak keys, and uncontrolled property spread (...req.body).
Race / GraphQL: Verify atomic DB transactions, introspection disabled, and query depth limits.

Scoring Impact

| --- | --- | --- | --- |

| Hardcoded Secrets | Any match | P0 | -25 |

| Plain-text PII in Logs | Any match | P0 | -20 |

| Unguarded Routes > 20% | > 0.2 | P0 | -15 |

| Raw SQL Concatenation | Any match | P1 | -10 |

| Response Leakage (Stack) | > 0 | P1 | -10 |

| Insecure Mobile Storage | Token in plaintext | P1 | -15 |

| Missing Cert Pinning | No pinning detected | P2 | -8 |

| DOM XSS Sinks | Any match | P1 | -10 |

> CAUTION: P0 finding immediately caps Security score at 40/100. Immediate actions for leaked secrets: rotate the credential NOW and purge from history.

Anti-Patterns

No applying generic patterns over project-specific rules: Respect existing security constraints.
No ignoring error handling or edge cases: Audit must cover boundary conditions.
No backend-only audit: Always check frontend AND mobile when in-scope.

References

Vulnerability Remediation Protocols
Mobile Audit Commands

Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:

Other skills for the same job

different authors, same section of the catalogue

Codebase Cleanup Deps Audit

by ComeOnOliver

×2

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

10k tokens

Security Best Practices

by openai

vendor ×1

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google, GitHub, Discord, etc.), two-factor authentication (TOTP, SMS), passkeys/WebAuthn support, session management, role-based access control (RBAC), rate limiting, and database adapters. Use when adding authentication to applications, implementing OAuth flows, setting up 2FA/MFA, managing user sessions, configuring authorization rules, or building secure authentication systems for web applications.

Package entire code repositories into single AI-friendly files using Repomix. Capabilities include pack codebases with customizable include/exclude patterns, generate multiple output formats (XML, Markdown, plain text), preserve file structure and context, optimize for AI consumption with token counting, filter by file types and directories, add custom headers and summaries. Use when packaging codebases for AI analysis, creating repository snapshots for LLM context, analyzing third-party libraries, preparing for security audits, generating documentation context, or evaluating unfamiliar codebases.

27k tokens scripts

Dependency Management Deps Audit

Expert patterns for HubSpot CRM integration including OAuth authentication, CRM objects, associations, batch operations, webhooks, and custom objects. Covers Node.js and Python SDKs.

5k tokens

Security Best Practices

by christophacham

×1

Perform language and framework specific security best-practice reviews and suggest improvements. Use when the user explicitly requests security best practices guidance, a security review or report, or secure-by-default coding help. Supports Python, JavaScript/TypeScript, and Go. Do NOT use for general code review, debugging, threat modeling (use security-threat-model), or non-security tasks.

102k tokens

API Gateway Configuration

by ComeOnOliver

×1

Configures API gateways for routing, authentication, rate limiting, and request transformation in microservice architectures. Use when setting up Kong, Nginx, AWS API Gateway, or Traefik for centralized API management.

525 tokens

How to use it

Copy the folder

Take hoangnguyen0403/common-security-audit from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.