agentleFS
Sign inStart free
witi-projectswiti-projects/Skills/auditing-security/SKILL.md

auditing-security

Skill2 starsChanged 6 months agoMITView on GitHub

Perform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns. Use when the user says "/auditing-security", "auditing security", or asks about auditing security.

  • Reads credentials

We split this skill into the rules it gives an agent

18 rules. 0 are common, 12 are distinctive, and 6 are very specific to this project.

  • 0

    Common

    Most of the 4 edited versions we read keep these.

  • 12

    Distinctive

    This author's own choices. Worth a look.

  • 6

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

    line 8
  2. Distinctive:

    Verify all API routes check authentication before processing.

    line 19
  3. Distinctive:

    Ensure role-based access control is enforced server-side, not just in the UI.

    line 20
  4. Distinctive:

    Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).

    line 21
  5. Distinctive:

    Verify session tokens are HTTP-only, secure, and have reasonable expiry.

    line 22
  6. Distinctive:

    SQL injection: look for string concatenation in SQL queries instead of parameterized queries.

    line 25
  7. Very specific:

    XSS: look for dangerouslySetInnerHTML, innerHTML, or unescaped user input rendered in templates.

    line 26
  8. Very specific:

    Command injection: look for exec(), eval(), child_process.exec() with user input.

    line 27
  9. Distinctive:

    Path traversal: check file operations for unsanitized user input in paths.

    line 28
  10. Very specific:

    Run npm audit or pip audit to check for known vulnerabilities.

    line 31
  11. Distinctive:

    Check for overly permissive dependency ranges.

    line 33
  12. Very specific:

    Verify CORS doesn't use Access-Control-Allow-Origin: * in production.

    line 36
  13. Distinctive:

    Check for Content Security Policy headers.

    line 37
  14. Very specific:

    Verify X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security headers.

    line 38
  15. Distinctive:

    Check API responses for leaking sensitive fields (password hashes, internal IDs, PII).

    line 41
  16. Distinctive:

    Verify error messages don't expose stack traces or internal details in production.

    line 42
  17. Distinctive:

    Check logging for sensitive data being written to logs.

    line 43
  18. Very specific:

    Always check .gitignore to ensure .env, credentials, and key files are excluded.

    line 50

“Common” is measured: kept by at least 6 in 10 of the 4 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Security Audit

Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

Steps

  1. Scan for hardcoded secrets — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like:
    • password=, secret=, token=, api_key=
    • Base64-encoded credentials
    • AWS keys (AKIA...), Stripe keys (sk_live_...), GitHub tokens (ghp_...)
    • Files: .env committed to git, config.json with credentials
  2. Check authentication & authorization
    • Verify all API routes check authentication before processing.
    • Ensure role-based access control is enforced server-side, not just in the UI.
    • Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).
    • Verify session tokens are HTTP-only, secure, and have reasonable expiry.
  3. Check for injection vulnerabilities
    • SQL injection: look for string concatenation in SQL queries instead of parameterized queries.
    • XSS: look for dangerouslySetInnerHTML, innerHTML, or unescaped user input rendered in templates.
    • Command injection: look for exec(), eval(), child_process.exec() with user input.
    • Path traversal: check file operations for unsanitized user input in paths.
  4. Review dependency security
    • Run npm audit or pip audit to check for known vulnerabilities.
    • Flag outdated dependencies with known CVEs.
    • Check for overly permissive dependency ranges.
  5. Check CORS and CSP configuration
    • Verify CORS doesn't use Access-Control-Allow-Origin: * in production.
    • Check for Content Security Policy headers.
    • Verify X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security headers.
  6. Review data exposure
    • Check API responses for leaking sensitive fields (password hashes, internal IDs, PII).
    • Verify error messages don't expose stack traces or internal details in production.
    • Check logging for sensitive data being written to logs.
  7. Generate report — produce a summary with severity ratings (Critical / High / Medium / Low) for each finding, with the file path, line number, and recommended fix.

Notes

  • This is a code review, not a penetration test. Recommend tools like npm audit, trivy, or snyk for automated scanning.
  • Always check .gitignore to ensure .env, credentials, and key files are excluded.
  • For comprehensive auditing, recommend the OWASP Testing Guide.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free