Security Auditor
- 981 installs
- 65 repo stars
- Updated June 21, 2026
- charon-fan/agent-playbook
security-auditor is a Claude Code security skill that automatically surfaces OWASP Top 10 vulnerabilities and common security flaws during code review or before deployment for developers hardening applications.
About
security-auditor is a security vulnerability expert skill from charon-fan/agent-playbook focused on OWASP Top 10 coverage and common application security issues. It activates when developers request security audits, mention security review, or review code for vulnerabilities before deployment. The skill uses Read, Grep, Glob, Bash, and WebSearch tools to inspect codebases and logs audit patterns via session hooks. Developers reach for security-auditor as a structured pre-ship gate when they need OWASP-aligned findings rather than ad-hoc grep for obvious mistakes. It pairs naturally with code review workflows where exploitable flaws must be caught before merge or production rollout.
- Expert in OWASP Top 10 with dedicated checks for each category
- Activates on explicit security audit requests or mentions of vulnerability
- Uses Read, Grep, Glob, Bash and WebSearch tools for deep codebase inspection
- Covers Broken Access Control, Cryptographic Failures and 8 more OWASP risks
- After_complete hooks trigger self-improving-agent and session-logger
Security Auditor by the numbers
- 981 all-time installs (skills.sh)
- +16 installs in the week ending Jul 28, 2026 (Skillselion tracking)
- Ranked #378 of 2,209 Security skills by installs in the Skillselion catalog
- Security screen: LOW risk (skills.sh audit)
- Data as of Jul 28, 2026 (Skillselion catalog sync)
npx skills add https://github.com/charon-fan/agent-playbook --skill security-auditorAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 981 |
|---|---|
| repo stars | ★ 65 |
| Security audit | 2 / 3 scanners passed |
| Last updated | June 21, 2026 |
| Repository | charon-fan/agent-playbook ↗ |
How do you audit code for OWASP Top 10 vulnerabilities?
Automatically surface OWASP Top 10 vulnerabilities and common security flaws during code review or before deployment.
Who is it for?
Developers conducting pre-deployment or PR security reviews who need structured OWASP Top 10 and common vulnerability detection in code.
Skip if: Infrastructure pentesting, compliance certification paperwork, or teams that only need unit test coverage without security analysis.
When should I use this skill?
The user requests a security audit, security review, vulnerability scan, or mentions OWASP or security flaws before deployment.
What you get
OWASP-aligned vulnerability findings, security audit notes, and prioritized flaw list for pre-deployment remediation.
- vulnerability findings list
- OWASP-aligned audit notes
By the numbers
- Covers OWASP Top 10 vulnerability categories
Files
Security Auditor
Expert in identifying security vulnerabilities following OWASP Top 10 and security best practices.
When This Skill Activates
Activates when you:
- Request a security audit
- Mention "security" or "vulnerability"
- Need security review
- Ask about OWASP
OWASP Top 10 Coverage
A01: Broken Access Control
Checks:
# Check for missing auth on protected routes
grep -r "@RequireAuth\|@Protected" src/
# Check for IDOR vulnerabilities
grep -r "req.params.id\|req.query.id" src/
# Check for role-based access
grep -r "if.*role.*===" src/Common Issues:
- Missing authentication on sensitive endpoints
- IDOR: Users can access other users' data
- Missing authorization checks
- API keys in URL
A02: Cryptographic Failures
Checks:
# Check for hardcoded secrets
grep -ri "password.*=.*['\"]" src/
grep -ri "api_key.*=.*['\"]" src/
grep -ri "secret.*=.*['\"]" src/
# Check for weak hashing
grep -r "md5\|sha1" src/
# Check for http URLs
grep -r "http:\/\/" src/Common Issues:
- Hardcoded credentials
- Weak hashing algorithms (MD5, SHA1)
- Unencrypted sensitive data
- HTTP instead of HTTPS
A03: Injection
Checks:
# SQL injection patterns
grep -r "\".*SELECT.*+.*\"" src/
grep -r "\".*UPDATE.*SET.*+.*\"" src/
# Command injection
grep -r "exec(\|system(\|spawn(" src/
grep -r "child_process.exec" src/
# Template injection
grep -r "render.*req\." src/Common Issues:
- SQL injection
- NoSQL injection
- Command injection
- XSS (Cross-Site Scripting)
- Template injection
A04: Insecure Design
Checks:
# Check for rate limiting
grep -r "rateLimit\|rate-limit\|throttle" src/
# Check for 2FA
grep -r "twoFactor\|2fa\|mfa" src/
# Check for session timeout
grep -r "maxAge\|expires\|timeout" src/Common Issues:
- No rate limiting on auth endpoints
- Missing 2FA for sensitive operations
- Session timeout too long
- No account lockout after failed attempts
A05: Security Misconfiguration
Checks:
# Check for debug mode
grep -r "DEBUG.*=.*True\|debug.*=.*true" src/
# Check for CORS configuration
grep -r "origin.*\*" src/
# Check for error messages
grep -r "console\.log.*error\|console\.error" src/Common Issues:
- Debug mode enabled in production
- Overly permissive CORS
- Verbose error messages
- Default credentials not changed
A06: Vulnerable Components
Checks:
# Check package files
cat package.json | grep -E "\"dependencies\"|\"devDependencies\""
cat requirements.txt
cat go.mod
# Run vulnerability scanner
npm audit
pip-auditCommon Issues:
- Outdated dependencies
- Known vulnerabilities in dependencies
- Unused dependencies
- Unmaintained packages
A07: Authentication Failures
Checks:
# Check password hashing
grep -r "bcrypt\|argon2\|scrypt" src/
# Check password requirements
grep -r "password.*length\|password.*complex" src/
# Check for password in URL
grep -r "password.*req\." src/Common Issues:
- Weak password hashing
- No password complexity requirements
- Password in URL
- Session fixation
A08: Software/Data Integrity
Checks:
# Check for subresource integrity
grep -r "integrity\|crossorigin" src/
# Check for signature verification
grep -r "verify.*signature\|validate.*token" src/Common Issues:
- No integrity checks
- Unsigned updates
- Unverified dependencies
A09: Logging Failures
Checks:
# Check for sensitive data in logs
grep -r "log.*password\|log.*token\|log.*secret" src/
# Check for audit trail
grep -r "audit\|activity.*log" src/Common Issues:
- Sensitive data in logs
- No audit trail for critical operations
- Logs not protected
- No log tampering detection
A10: SSRF (Server-Side Request Forgery)
Checks:
# Check for arbitrary URL fetching
grep -r "fetch(\|axios(\|request(\|http\\.get" src/
# Check for webhook URLs
grep -r "webhook.*url\|callback.*url" src/Common Issues:
- No URL validation
- Fetching user-supplied URLs
- No allowlist for external calls
Security Audit Checklist
Code Review
- [ ] No hardcoded secrets
- [ ] Input validation on all inputs
- [ ] Output encoding for XSS prevention
- [ ] Parameterized queries for SQL
- [ ] Proper error handling
- [ ] Authentication on protected routes
- [ ] Authorization checks
- [ ] Rate limiting on public APIs
Configuration
- [ ] Debug mode off
- [ ] HTTPS enforced
- [ ] CORS configured correctly
- [ ] Security headers set
- [ ] Environment variables for secrets
- [ ] Database not exposed
Dependencies
- [ ] No known vulnerabilities
- [ ] Dependencies up to date
- [ ] Unused dependencies removed
Scripts
Run security audit:
python scripts/security_audit.pyCheck for secrets:
python scripts/find_secrets.pyReferences
references/owasp.md- OWASP Top 10 detailsreferences/checklist.md- Security audit checklistreferences/remediation.md- Vulnerability remediation guide
Security Auditor
A Claude Code skill for security audits and vulnerability assessment.
Installation
This skill is part of the agent-playbook collection.
Usage
You: Audit this code for security issues
You: Check for vulnerabilities
You: Is this code secure?OWASP Top 10 Coverage
| Category | Checks |
|---|---|
| A01 | Access Control |
| A02 | Cryptographic Failures |
| A03 | Injection |
| A04 | Insecure Design |
| A05 | Security Misconfiguration |
| A06 | Vulnerable Components |
| A07 | Authentication Failures |
| A08 | Data Integrity |
| A09 | Logging Failures |
| A10 | SSRF |
Scripts
Run security audit:
python scripts/security_audit.pyFind secrets:
python scripts/find_secrets.pyResources
Security Review Checklist
- [ ] Input validation
- [ ] Auth and authz checks
- [ ] Secrets management
- [ ] Dependency vulnerability scan
- [ ] Logging and monitoring
OWASP Top 10 (2021)
1. Broken Access Control 2. Cryptographic Failures 3. Injection 4. Insecure Design 5. Security Misconfiguration 6. Vulnerable and Outdated Components 7. Identification and Authentication Failures 8. Software and Data Integrity Failures 9. Security Logging and Monitoring Failures 10. Server-Side Request Forgery
Remediation Notes
Steps
1. Reproduce the issue 2. Identify impacted components 3. Patch and add tests 4. Document the change
#!/usr/bin/env python3
# Lightweight secret scanner for common patterns.
from pathlib import Path
import argparse
import re
DEFAULT_IGNORE_DIRS = {
".git",
".hg",
".svn",
".claude",
".codex",
".gemini",
"__pycache__",
"node_modules",
"dist",
"build",
"coverage",
"sessions",
}
PATTERNS = [
re.compile(r"AKIA[0-9A-Z]{16}"),
re.compile(r"AIza[0-9A-Za-z_-]{35}"),
re.compile(r"sk-[0-9A-Za-z]{20,}"),
]
def is_text_file(path: Path, max_bytes: int) -> bool:
try:
if path.stat().st_size > max_bytes:
return False
data = path.read_bytes()
except OSError:
return False
return b"\x00" not in data
def iter_files(root: Path, ignored_dirs: set[str]):
if root.is_file():
yield root
return
for file_path in root.rglob("*"):
if any(part in ignored_dirs for part in file_path.parts):
continue
if file_path.is_file():
yield file_path
def main() -> int:
parser = argparse.ArgumentParser(description="Scan for common secret patterns.")
parser.add_argument("path", nargs="?", default=".", help="Path to scan")
parser.add_argument("--max-bytes", type=int, default=1_000_000, help="Skip files larger than this")
parser.add_argument(
"--ignore-dir",
action="append",
default=[],
help="Directory name to ignore; can be repeated",
)
args = parser.parse_args()
root = Path(args.path)
if not root.exists():
print("Path not found: " + str(root))
return 1
matches = []
ignored_dirs = DEFAULT_IGNORE_DIRS | set(args.ignore_dir)
for file_path in iter_files(root, ignored_dirs):
if file_path.suffix in {".png", ".jpg", ".jpeg", ".gif", ".pdf"}:
continue
if not is_text_file(file_path, args.max_bytes):
continue
text = file_path.read_text(encoding="utf-8", errors="ignore")
for pattern in PATTERNS:
if pattern.search(text):
matches.append(str(file_path))
break
if matches:
print("Potential secrets found:")
for match in matches:
print("- " + match)
return 1
print("No secrets found.")
return 0
if __name__ == "__main__":
raise SystemExit(main())
#!/usr/bin/env python3
# Template generator for security audit.
from pathlib import Path
import argparse
import textwrap
def write_output(path: Path, content: str, force: bool) -> bool:
if path.exists() and not force:
print(f"{path} already exists (use --force to overwrite)")
return False
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text(content, encoding="utf-8")
return True
def main() -> int:
parser = argparse.ArgumentParser(description="Generate a security audit report.")
parser.add_argument("--output", default="security-audit.md", help="Output file path")
parser.add_argument("--name", default="example", help="System or scope name")
parser.add_argument("--owner", default="team", help="Owning team")
parser.add_argument("--force", action="store_true", help="Overwrite existing file")
args = parser.parse_args()
content = textwrap.dedent(
f"""\
# Security Audit
## Scope
{args.name}
## Ownership
- Owner: {args.owner}
- Security contact: TBD
## Threat Model
- Assets
- Entry points
- Trust boundaries
## Findings
| Severity | Issue | Impact | Recommendation |
| --- | --- | --- | --- |
| None yet | Add validated findings here | TBD | TBD |
## Remediation Plan
- Immediate fixes
- Long-term hardening
## Evidence
- Logs, scans, and screenshots
"""
).strip() + "\n"
output = Path(args.output)
if not write_output(output, content, args.force):
return 1
print(f"Wrote {output}")
return 0
if __name__ == "__main__":
raise SystemExit(main())
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets476k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.475k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.78.9k204
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.77.7k388
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.64.9k85How it compares
Use security-auditor for OWASP-focused code review; use agent-analyze-code-quality when the goal is general debt and smell analysis rather than exploit-focused findings.
FAQ
What standards does security-auditor follow?
security-auditor follows OWASP Top 10 and common application security best practices. The skill activates on security audit requests and reviews code for vulnerabilities before deployment or during explicit security review sessions.
Which tools does security-auditor use?
security-auditor is allowed Read, Grep, Glob, Bash, and WebSearch to inspect codebases. After completion, hooks can trigger session-logger for audit logging and self-improving-agent for pattern learning.
Is Security Auditor safe to install?
skills.sh reports 2 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.