chrislema·chrislema/skills/security-assessment/SKILL.md

security-assessment

Skill0 starsChanged 5 months agoNo licenceView on GitHub

Defensive security audit of a web application, layer by layer: transport (login over non-HTTPS, cookie flags), authentication (backdoors and debug bypasses left open, hardcoded or default credentials, weak password policy, session/JWT handling), authorization (IDOR, missing ownership checks, privilege escalation), input handling (SQL injection, XSS, CSRF, SSRF, path traversal, uploads), data exposure (secrets in the repo, PII in logs, over-fetching APIs, verbose errors), and configuration (open CORS, debug mode on, exposed admin routes). Ranks findings by likelihood × impact so a wide-open unauthenticated hole outranks a theoretical root-only attack — 'an admin with root access could delete everything' is not a five-alarm fire. Use for a security review, security audit, pre-launch hardening pass, 'is this app safe', or after AI agents have built features fast and nobody has checked the doors. Builds a test baseline first, then outputs prioritized, Sonnet-executable work orders where every fix carries proof the hole is closed AND the legitimate path still works.