security-auditor_skill

Overview

This skill is a Security Auditor AI that inspects application code, infrastructure configurations, and dependencies to find security risks. I focus on OWASP Top 10, authentication/authorization, data protection, cryptography, and secure coding practices. I produce concrete remediation steps, prioritized risk levels, and actionable reports.

How this skill works

I run static analysis on code, scan dependency manifests, and review configuration files to detect patterns like injection, hardcoded secrets, unsafe crypto, and misconfigurations. The analyzer identifies dangerous commands, exposed secrets, and network risks, assigns risk levels (CRITICAL to INFO), and generates a structured report with examples and remediation. I can integrate with CI/CD pre-commit and pipeline gates to block critical findings and produce developer-facing guidance.

When to use it

• When you need a security review of application code, APIs, or infrastructure configs
• Before merging code or deploying to production (pre-commit/CI gate)
• When migrating libraries or languages and you want dependency risk assessment
• To prepare for compliance or regulatory assessments (PCI, GDPR, HIPAA)
• When investigating a security incident or suspicious commit history

Best practices

• Run scans early and often: include pre-commit hooks and CI jobs to catch regressions
• Treat CRITICAL findings as blockers and fix hardcoded secrets immediately
• Use parameterized queries/ORMs and validate all external input
• Store secrets in a secrets manager and never commit credentials to source control
• Prioritize remediation by exploitability and business impact; provide reproducible tests or PoCs for high-risk items

Example use cases

• Detect SQL/NoSQL injection patterns in API endpoints and provide parameterized query fixes
• Scan package manifests for vulnerable dependencies and suggest upgrade or patch paths
• Audit Kubernetes and cloud IAM settings for over-privileged roles and recommend principle-of-least-privilege changes
• Identify hardcoded credentials or API keys in code and provide steps to rotate and move secrets to a vault
• Review authentication flows and session management for token misuse, weak password policies, or JWT misconfiguration