Security Audit

Name: Security Audit
Author: 89jobrien

89jobrien/steve

44 installs
4 repo stars
Updated April 11, 2026
89jobrien/steve

security-audit is a Claude Code skill for security code review and vulnerability assessment using OWASP Top 10, CVSS scoring, CWE mapping, and remediation roadmaps.

About

security-audit is a Claude Code skill for security code review and vulnerability assessment. It runs OWASP Top 10 assessments, scores findings with CVSS, maps them to CWE classifications, audits dependencies, and produces a remediation roadmap. A developer uses it for security reviews before release, compliance audits, or penetration-test preparation.

OWASP Top 10 (2021) assessment with CVSS scoring and CWE references
Ships an audit-report template and an OWASP checklist reference
Covers dependency vulnerability audit and remediation roadmaps

Security Audit by the numbers

44 all-time installs (skills.sh)
Ranked #1,378 of 2,203 Security skills by installs in the Skillselion catalog
Data as of Jul 28, 2026 (Skillselion catalog sync)

At a glance

security-audit capabilities & compatibility

Capabilities: security audit · owasp assessment · vulnerability scanning · dependency audit
Use cases: security audit · code review
Pricing: Free

From the docs

What security-audit says it does

Comprehensive security auditing covering code review, vulnerability assessment, OWASP Top 10, dependency analysis, and remediation planning.

SKILL.md

Quick reference for OWASP Top 10 (2021) vulnerability categories.

references/owasp-checklist.md

npx skills add https://github.com/89jobrien/steve --skill security-audit

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/89jobrien/steve/security-audit.svg)](https://skillselion.com/skills/89jobrien/steve/security-audit)

Installs	44
repo stars	★ 4
Last updated	April 11, 2026
Repository	89jobrien/steve ↗

What it does

Run an OWASP-based security audit of a codebase and produce a severity-ranked findings report.

Who is it for?

Security reviews before release, compliance audits, penetration-test prep, and dependency vulnerability assessment.

Skip if: Designing new security architecture or implementing controls (see security-engineering for that).

When should I use this skill?

Conducting security reviews, analyzing code for vulnerabilities, or performing OWASP assessments.

What you get

Findings are documented by severity with CVSS scores, CWE classification, proof of concept, and a remediation roadmap.

security audit report
severity-ranked findings
remediation roadmap

By the numbers

OWASP Top 10 (2021) categories
10+ common CWE references
2 reference files (OWASP checklist + audit template)

Files

SKILL.mdMarkdownGitHub ↗

Security Audit Skill

Comprehensive security auditing covering code review, vulnerability assessment, OWASP Top 10, dependency analysis, and remediation planning.

What This Skill Does

Conducts security code reviews
Identifies vulnerabilities (CVSS scoring)
Performs OWASP Top 10 assessments
Audits authentication/authorization
Reviews data protection controls
Analyzes dependency vulnerabilities
Creates remediation roadmaps

When to Use

Security reviews before release
Compliance audits
Penetration test preparation
Incident response analysis
Dependency vulnerability assessment

Reference Files

references/SECURITY_AUDIT.template.md - Comprehensive security audit report format
references/owasp_checklist.md - OWASP Top 10 checklist with CVSS scoring and CWE references

Workflow

1. Define scope and methodology 2. Perform static/dynamic analysis 3. Document findings by severity 4. Map to OWASP categories 5. Create remediation roadmap 6. Verify fixes

Output Format

Security findings should include:

Severity (Critical/High/Medium/Low)
CVSS score and vector
CWE classification
Proof of concept
Remediation steps

OWASP Top 10 Security Checklist

Quick reference for OWASP Top 10 (2021) vulnerability categories.

A01: Broken Access Control

[ ] Verify authorization on all endpoints
[ ] Check for IDOR vulnerabilities
[ ] Validate role-based access controls
[ ] Test for privilege escalation
[ ] Verify JWT/session token handling

A02: Cryptographic Failures

[ ] Check for sensitive data in transit (TLS 1.2+)
[ ] Verify encryption at rest for sensitive data
[ ] Review password hashing (bcrypt, Argon2)
[ ] Check for hardcoded secrets/keys
[ ] Validate certificate handling

A03: Injection

[ ] SQL injection (parameterized queries)
[ ] Command injection (input sanitization)
[ ] XSS (output encoding)
[ ] LDAP injection
[ ] NoSQL injection

A04: Insecure Design

[ ] Threat modeling completed
[ ] Security requirements defined
[ ] Attack surface minimized
[ ] Defense in depth applied
[ ] Fail-secure defaults

A05: Security Misconfiguration

[ ] Default credentials changed
[ ] Unnecessary features disabled
[ ] Error handling doesn't leak info
[ ] Security headers configured
[ ] Cloud permissions least-privilege

A06: Vulnerable Components

[ ] Dependency audit (npm audit, pip-audit)
[ ] No known CVEs in dependencies
[ ] Components up to date
[ ] Unused dependencies removed
[ ] License compliance checked

A07: Authentication Failures

[ ] Strong password policy enforced
[ ] MFA available/required
[ ] Account lockout implemented
[ ] Session management secure
[ ] Password recovery secure

A08: Software and Data Integrity

[ ] CI/CD pipeline secured
[ ] Code signing implemented
[ ] Dependency integrity verified
[ ] Serialization safe
[ ] Update mechanism secure

A09: Security Logging and Monitoring

[ ] Authentication events logged
[ ] Authorization failures logged
[ ] Input validation failures logged
[ ] Logs protected from tampering
[ ] Alerting configured

A10: Server-Side Request Forgery (SSRF)

[ ] URL validation on user input
[ ] Allowlist for external requests
[ ] Internal network access blocked
[ ] Response handling secure
[ ] Cloud metadata endpoints blocked

CVSS Scoring Reference

Severity	Score Range	Response Time
Critical	9.0 - 10.0	Immediate
High	7.0 - 8.9	24-48 hours
Medium	4.0 - 6.9	1-2 weeks
Low	0.1 - 3.9	Next release

Common CWE References

CWE-79: Cross-site Scripting (XSS)
CWE-89: SQL Injection
CWE-287: Improper Authentication
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-434: Unrestricted File Upload
CWE-502: Deserialization of Untrusted Data
CWE-611: XML External Entity (XXE)
CWE-798: Use of Hard-coded Credentials
CWE-862: Missing Authorization
CWE-918: Server-Side Request Forgery (SSRF)

Security Audit Report

Target: {{APPLICATION_OR_SYSTEM}} Date: {{YYYY-MM-DD}} Auditor: {{NAME}} Scope: {{SCOPE_DESCRIPTION}}

---

Executive Summary

Severity	Count
Critical	{{N}}
High	{{N}}
Medium	{{N}}
Low	{{N}}
Info	{{N}}

Overall Risk Level: {{CRITICAL|HIGH|MEDIUM|LOW}}

Key Findings

1. {{CRITICAL_FINDING_SUMMARY}} 2. {{HIGH_FINDING_SUMMARY}} 3. {{NOTABLE_FINDING_SUMMARY}}

---

Scope & Methodology

In Scope

{{COMPONENT_1}}
{{COMPONENT_2}}
{{ENDPOINT_RANGE}}

Out of Scope

{{EXCLUDED_1}}
{{EXCLUDED_2}}

Testing Methodology

Type	Performed
Static Analysis	{{YES/NO}}
Dynamic Testing	{{YES/NO}}
Dependency Scan	{{YES/NO}}
Manual Review	{{YES/NO}}
Penetration Test	{{YES/NO}}

Tools Used

{{TOOL_1}}: {{PURPOSE}}
{{TOOL_2}}: {{PURPOSE}}

---

Findings

CRITICAL: {{FINDING_TITLE}}

ID: {{VULN-001}} CVSS: {{SCORE}} ({{VECTOR}}) CWE: {{CWE-XXX}} Location: {{FILE_PATH}}:{{LINE}}

Description: {{DETAILED_DESCRIPTION}}

Proof of Concept:

```{{LANGUAGE}} {{POC_CODE_OR_STEPS}}


**Impact:**
{{WHAT_AN_ATTACKER_COULD_DO}}

**Recommendation:**


**References:**

- [{{REFERENCE}}]({{URL}})

---

### HIGH: {{FINDING_TITLE}}

**ID:** {{VULN-002}}
**CVSS:** {{SCORE}}
**CWE:** {{CWE-XXX}}
**Location:** `{{FILE_PATH}}`

**Description:**
{{DETAILED_DESCRIPTION}}

**Impact:**
{{IMPACT_DESCRIPTION}}

**Recommendation:**
{{REMEDIATION_STEPS}}

---

### MEDIUM: {{FINDING_TITLE}}

**ID:** {{VULN-003}}
**Location:** `{{FILE_PATH}}`

**Description:**
{{DESCRIPTION}}

**Recommendation:**
{{REMEDIATION}}

---

### LOW: {{FINDING_TITLE}}

**ID:** {{VULN-004}}

**Description:**
{{DESCRIPTION}}

**Recommendation:**
{{REMEDIATION}}

---

## OWASP Top 10 Coverage

| Category | Status | Findings |
|----------|--------|----------|
| A01: Broken Access Control | {{TESTED}} | {{N}} |
| A02: Cryptographic Failures | {{TESTED}} | {{N}} |
| A03: Injection | {{TESTED}} | {{N}} |
| A04: Insecure Design | {{TESTED}} | {{N}} |
| A05: Security Misconfiguration | {{TESTED}} | {{N}} |
| A06: Vulnerable Components | {{TESTED}} | {{N}} |
| A07: Auth Failures | {{TESTED}} | {{N}} |
| A08: Data Integrity Failures | {{TESTED}} | {{N}} |
| A09: Logging Failures | {{TESTED}} | {{N}} |
| A10: SSRF | {{TESTED}} | {{N}} |

---

## Dependency Audit

### Vulnerable Dependencies

| Package | Version | Vulnerability | Severity | Fix Version |
|---------|---------|---------------|----------|-------------|
| {{PKG}} | {{VER}} | {{CVE-XXXX}} | {{SEV}} | {{VER}} |

### Outdated Dependencies

| Package | Current | Latest | Risk |
|---------|---------|--------|------|
| {{PKG}} | {{VER}} | {{VER}} | {{RISK}} |

---

## Authentication & Authorization

| Control | Status | Notes |
|---------|--------|-------|
| Password Policy | {{PASS/FAIL}} | {{NOTES}} |
| Session Management | {{PASS/FAIL}} | {{NOTES}} |
| MFA Support | {{PASS/FAIL}} | {{NOTES}} |
| Role-Based Access | {{PASS/FAIL}} | {{NOTES}} |
| Token Security | {{PASS/FAIL}} | {{NOTES}} |

---

## Data Protection

| Control | Status | Notes |
|---------|--------|-------|
| Encryption at Rest | {{PASS/FAIL}} | {{NOTES}} |
| Encryption in Transit | {{PASS/FAIL}} | {{NOTES}} |
| PII Handling | {{PASS/FAIL}} | {{NOTES}} |
| Secrets Management | {{PASS/FAIL}} | {{NOTES}} |

---

## Infrastructure Security

| Control | Status | Notes |
|---------|--------|-------|
| Firewall Rules | {{PASS/FAIL}} | {{NOTES}} |
| Network Segmentation | {{PASS/FAIL}} | {{NOTES}} |
| Container Security | {{PASS/FAIL}} | {{NOTES}} |
| Cloud Config | {{PASS/FAIL}} | {{NOTES}} |

---

## Remediation Roadmap

### Immediate (24-48 hours)

1. [ ] {{CRITICAL_FIX_1}}
2. [ ] {{CRITICAL_FIX_2}}

### Short-term (1-2 weeks)

1. [ ] {{HIGH_FIX_1}}
2. [ ] {{HIGH_FIX_2}}

### Medium-term (1 month)

1. [ ] {{MEDIUM_FIX_1}}
2. [ ] {{MEDIUM_FIX_2}}

---

## Appendix

### A. Scan Outputs

<details>
<summary>Static Analysis Results</summary>


</details>

### B. Testing Evidence

| Test | Evidence |
|------|----------|
| {{TEST}} | {{SCREENSHOT_OR_LOG}} |

---

## Quality Checklist

- [ ] All in-scope components tested
- [ ] OWASP Top 10 covered
- [ ] Dependencies scanned
- [ ] Findings reproducible
- [ ] Remediation actionable
- [ ] Risk ratings justified
- [ ] Evidence documented