security-auditing_skill

Overview

This skill helps conduct comprehensive security audits of code to identify vulnerabilities in authentication, input handling, cryptography, and APIs. It delivers structured guidance for locating, classifying, and remediating security issues before they are exploitable. Use it to improve code-level defenses, reduce risk, and produce actionable remediation steps.

How this skill works

The skill inspects code flows from user input to sensitive operations, focusing on authentication, authorization, injection vectors, cryptographic usage, and API controls. It applies a systematic methodology: threat modeling, code flow analysis, pattern detection for common vulnerabilities, attack simulation, and defense verification. The output is a prioritized set of findings with clear impact and remediation guidance.

When to use it

• Reviewing authentication and authorization implementations
• Auditing for injection risks (SQL, NoSQL, command, XSS)
• Validating input sanitization, file uploads, and output encoding
• Assessing cryptography, key management, and transport security
• Reviewing API security: rate limits, object-level auth, and security headers

Best practices

• Trace user input end-to-end and validate at the server boundary
• Use parameterized queries and vetted libraries instead of string concatenation or custom crypto
• Enforce least privilege and object-level authorization on every sensitive endpoint
• Avoid hardcoded secrets; use a secrets manager and rotate keys regularly
• Apply context-appropriate encoding for output (HTML, JS, URL) and set security headers

Example use cases

• Pre-merge review of a feature that adds new API endpoints handling PII
• Audit of authentication flows and JWT handling after a login redesign
• Investigation of a reported vulnerability involving file uploads or command invocation
• Quarterly security review to check dependencies, CVEs, and configuration settings
• Assessment prior to public launch to ensure OWASP Top 10 coverage and rate limiting