security-audit

Name: security-audit
Author: pssah4

34stars5forks

How to install security-audit?

pssah4/digital-innovation-agents/security-audit

$npx -y skills add pssah4/digital-innovation-agents --skill security-audit

Installs into the current project.

Summary

Performs a COMPREHENSIVE, formal security audit of an entire codebase and produces a written audit report (AUDIT-{PROJECT}-{DATE}.md) with prioritized findings (H/M/L) and a remediation plan. Covers SAST, OWASP Top 10, OWASP LLM Top 10, SCA (dependency analysis), Zero Trust valid

Files · 1

View on GitHub

SKILL.md

1	# Security Auditor
2
3	You perform a comprehensive security audit covering dependency analysis
4	through code review. Output is a prioritized security report with a
5	concrete remediation plan.
6
7	Input: Codebase (`src/`), dependencies, configuration.
8	Output: `_devprocess/analysis/AUDIT-{PROJECT}-{YYYY-MM-DD}.md`.
9
10	See `skills/project-conventions/SKILL.md#canonical-specs` (Writing style)
11	and (Frontmatter spec). Both apply to every artifact this skill produces.
12
13	## Pre-Phase 0: Branch and item check
14
15	Two modes:
16
17	- Per-item audit (inside `/coding` or before merging a feature): runs
18	on the item's branch. `sec-done` tag goes on the same branch.
19	- Periodic full-codebase audit: runs on `feature/audit-<YYYY-MM-DD>`,
20	produces a standalone AUDIT report, queues FIX/IMP follow-ups. No draft
21	PR for the audit branch; follow-ups get their own branches via `/coding`.
22
23	Per-item audit: identify the active item, verify branch matches, then run
24	`flow.py create-issue` and `flow.py open-draft-pr` (idempotent). At the
25	Handoff Ritual end, run `flow.py tag-phase --item <ID> --phase sec`.
26
27	Full rules: `skills/project-conventions/references/team-workflow.md`.
28
29	## Scope
30
31	In scope: SAST (CWE-based), OWASP Top 10, OWASP LLM Top 10 (when AI/LLM
32	is present), SCA (dependencies, licenses), Zero Trust (trust boundaries,
33	input validation), code quality security patterns.
34
35	Out of scope: penetration testing, compliance certification, architecture
36	design (done by `/architecture`).
37
38	## Audit Phases
39
40	\| Phase \| Activity \| Reference \|
41	\|---\|---\|---\|
42	\| 1. Reconnaissance \| Identify stack, framework, runtime, dependency count, existing measures. Internal analysis only; nothing from this phase appears as a standalone report section. \| -- \|
43	\| 2. SAST \| Grep and analyze code per CWE patterns. \| `references/cwe-patterns.md` \|
44	\| 3. OWASP Top 10 \| Check A01-A10. \| `references/owasp-checklist.md` \|
45	\| 4. OWASP LLM Top 10 \| Only if LLM APIs are used. Check LLM01-LLM10. \| `references/owasp-llm-checklist.md` \|
46	\| 5. SCA \| `npm audit --json` or `pip-audit --format json`; license check. Classify by Runtime / Dev / Transitive. \| -- \|
47	\| 6. Zero Trust + Quality \| Input validation, least privilege, defense in depth, fail-closed defaults, audit trail, error handling, resource management, race conditions, hardcoded credentials, debug code. \| -- \|
48
49	## Finding format (binding)
50
51	Each finding caps at five fields. Code diff only when the fix is not
52	obvious from the remediation sentence.
53
54	```
55	H-N: <title>
56	- Severity: Critical \| High \| Medium \| Low \| Info
57	- CWE-ID: CWE-XXX
58	- Location: <file:line>
59	- Risk: <one sentence>
60	- Remediation: <one sentence with concrete action>
61	```
62
63	Status values: `Confirmed`, `Mitigated`, `False Positive`, `Resolved`.
64	State the status, never leave a false positive silent. Consider context
65	(DevDependency vs. Runtime).
66
67	Positive findings: up to 3 entries, skip entirely when overall risk
68	is High or Critical. The team needs the negative list, not encouragement.
69
70	Severity schema: Critical (immediately exploitable, data loss / RCE),
71	High (exploitable with low effort, significant impact), Medium
72	(exploitable under specific conditions), Low (best-practice
73	improvement), Info (note, no direct threat).
74
75	## Audit summary block (canonical, define once)
76
77	Defined here. Do not restate the block in re-audit output or in the
78	Handoff Ritual entry; reference the report instead.
79
80	```
81	=== Security Audit Result ===
82
83	Overall risk: {Critical / High / Medium / Low}
84
85	P1 (Must Fix, Critical + High): {N} findings
86	- {H-1}: {title}, {file:line}, effort {S/M/L}
87
88	P2 (Should Fix, Medium): {N} findings
89	- {M-1}: {title}, {file:line}, effort {S/M/L}
90
91	P3 (Consider, Low + Info): {N} findings
92	- {L-1}: {title}, effort {S/M/L}
93
94	Positive findings: {up to 3, omitted when overall risk High or Critical}
95	```
96
97	## When to run
98
99	Before every release, after significant security-relevant changes,
100	periodically (monthly for active projects), after dependency updates
101	(SCA phase).
102
103	## Create the report
104
105	Read `templates/AUDIT-TEMPLATE.md`, fill it, save to

People who liked this also viewed

6 picks

Type

security-audit

34stars5forks

View on GitHub

How to install security-audit?

pssah4/digital-innovation-agents/security-audit

$npx -y skills add pssah4/digital-innovation-agents --skill security-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Security Auditor
2
3	You perform a comprehensive security audit covering dependency analysis
4	through code review. Output is a prioritized security report with a
5	concrete remediation plan.
6
7	Input: Codebase (`src/`), dependencies, configuration.
8	Output: `_devprocess/analysis/AUDIT-{PROJECT}-{YYYY-MM-DD}.md`.
9
10	See `skills/project-conventions/SKILL.md#canonical-specs` (Writing style)
11	and (Frontmatter spec). Both apply to every artifact this skill produces.
12
13	## Pre-Phase 0: Branch and item check
14
15	Two modes:
16
17	- Per-item audit (inside `/coding` or before merging a feature): runs
18	on the item's branch. `sec-done` tag goes on the same branch.
19	- Periodic full-codebase audit: runs on `feature/audit-<YYYY-MM-DD>`,
20	produces a standalone AUDIT report, queues FIX/IMP follow-ups. No draft
21	PR for the audit branch; follow-ups get their own branches via `/coding`.
22
23	Per-item audit: identify the active item, verify branch matches, then run
24	`flow.py create-issue` and `flow.py open-draft-pr` (idempotent). At the
25	Handoff Ritual end, run `flow.py tag-phase --item <ID> --phase sec`.
26
27	Full rules: `skills/project-conventions/references/team-workflow.md`.
28
29	## Scope
30
31	In scope: SAST (CWE-based), OWASP Top 10, OWASP LLM Top 10 (when AI/LLM
32	is present), SCA (dependencies, licenses), Zero Trust (trust boundaries,
33	input validation), code quality security patterns.
34
35	Out of scope: penetration testing, compliance certification, architecture
36	design (done by `/architecture`).
37
38	## Audit Phases
39
40	\| Phase \| Activity \| Reference \|
41	\|---\|---\|---\|
42	\| 1. Reconnaissance \| Identify stack, framework, runtime, dependency count, existing measures. Internal analysis only; nothing from this phase appears as a standalone report section. \| -- \|
43	\| 2. SAST \| Grep and analyze code per CWE patterns. \| `references/cwe-patterns.md` \|
44	\| 3. OWASP Top 10 \| Check A01-A10. \| `references/owasp-checklist.md` \|
45	\| 4. OWASP LLM Top 10 \| Only if LLM APIs are used. Check LLM01-LLM10. \| `references/owasp-llm-checklist.md` \|
46	\| 5. SCA \| `npm audit --json` or `pip-audit --format json`; license check. Classify by Runtime / Dev / Transitive. \| -- \|
47	\| 6. Zero Trust + Quality \| Input validation, least privilege, defense in depth, fail-closed defaults, audit trail, error handling, resource management, race conditions, hardcoded credentials, debug code. \| -- \|
48
49	## Finding format (binding)
50
51	Each finding caps at five fields. Code diff only when the fix is not
52	obvious from the remediation sentence.
53
54	```
55	H-N: <title>
56	- Severity: Critical \| High \| Medium \| Low \| Info
57	- CWE-ID: CWE-XXX
58	- Location: <file:line>
59	- Risk: <one sentence>
60	- Remediation: <one sentence with concrete action>
61	```
62
63	Status values: `Confirmed`, `Mitigated`, `False Positive`, `Resolved`.
64	State the status, never leave a false positive silent. Consider context
65	(DevDependency vs. Runtime).
66
67	Positive findings: up to 3 entries, skip entirely when overall risk
68	is High or Critical. The team needs the negative list, not encouragement.
69
70	Severity schema: Critical (immediately exploitable, data loss / RCE),
71	High (exploitable with low effort, significant impact), Medium
72	(exploitable under specific conditions), Low (best-practice
73	improvement), Info (note, no direct threat).
74
75	## Audit summary block (canonical, define once)
76
77	Defined here. Do not restate the block in re-audit output or in the
78	Handoff Ritual entry; reference the report instead.
79
80	```
81	=== Security Audit Result ===
82
83	Overall risk: {Critical / High / Medium / Low}
84
85	P1 (Must Fix, Critical + High): {N} findings
86	- {H-1}: {title}, {file:line}, effort {S/M/L}
87
88	P2 (Should Fix, Medium): {N} findings
89	- {M-1}: {title}, {file:line}, effort {S/M/L}
90
91	P3 (Consider, Low + Info): {N} findings
92	- {L-1}: {title}, effort {S/M/L}
93
94	Positive findings: {up to 3, omitted when overall risk High or Critical}
95	```
96
97	## When to run
98
99	Before every release, after significant security-relevant changes,
100	periodically (monthly for active projects), after dependency updates
101	(SCA phase).
102
103	## Create the report
104
105	Read `templates/AUDIT-TEMPLATE.md`, fill it, save to

People who liked this also viewed

6 picks

Type