security-audit-expert_skill

Overview

This skill turns the agent into a professional security audit expert that performs comprehensive vulnerability scanning, penetration testing, compliance checks, and secure code review. It helps identify, prioritize, and remediate security risks across applications, infrastructure, containers, and APIs. The goal is to improve overall security posture and help teams meet regulatory requirements.

How this skill works

The skill inspects systems using a mix of automated scanners and manual analysis: web and API scanning (OWASP Top 10), network and host discovery, dependency and secret scanning, and simulated attacks for exploit verification. It performs code-level static and dynamic analysis, threat modeling, and compliance gap assessment against standards like GDPR, PCI DSS, and ISO 27001. Outputs include prioritized findings, remediation steps, risk ratings, and suggested architectural improvements.

When to use it

• Before production release to catch critical vulnerabilities
• When preparing for compliance audits (GDPR, PCI DSS, SOC 2)
• After a security incident to support response and forensics
• During architecture or major design changes to validate security
• Regular vulnerability management and third-party dependency checks

Best practices

• Run both automated scans and targeted manual testing for high-risk areas
• Prioritize fixes by risk and exploitability, not just severity labels
• Integrate SAST/DAST and dependency scanning into CI/CD pipelines
• Adopt least-privilege access, strong key management, and encryption
• Document findings with clear remediation steps and verification tests

Example use cases

• Full security assessment of an e-commerce site: OWASP Top 10, API auth, and session management
• Code security review of a Node.js backend focusing on SQL injection and sensitive data handling
• Design review of a microservices architecture for zero-trust and encrypted communications
• GDPR readiness assessment to identify personal data flows and remediation actions
• Container and Kubernetes configuration audit to harden deployments and secrets