security-audit — Claude Code command: what it does, how to install
Runs a structured security review on your codebase, dependencies, and configuration. Handy before shipping to production or during code audits.
npx claude-code-templates@latest --command security/security-auditWhat security-audit does
The command inspects the project environment using Read, Bash, Grep, and Glob. It checks current package managers via npm audit or pip check, reads @.env* files, inspects @.github/workflows/security.yml or @security/, and reviews recent commits flagged with security fixes.
The audit covers ten areas. These include dependency checks with tools like cargo audit, hardcoded secret scans, input validation flaws like SQL injection or XSS, CORS settings, and data encryption.
Findings are ranked by severity from Low to Critical with code snippets and remediation steps. If no supported package manager is installed, the dependency check falls back to reporting that none was detected.
What it helps with
- scan dependencies for known vulnerabilities using npm audit or pip check
- detect hardcoded API keys and secrets in environment files
- identify input validation bugs including SQL injection and XSS
- review security headers, CORS settings, and CI/CD pipelines
- produce a categorized report with remediation code examples
Example prompts for the agent
- /security-audit --full
- /security-audit dependencies
- /security-audit Check input sanitization and authentication logic
How to install security-audit
1claude-code-templates
npx claude-code-templates@latest --command security/security-audit2Manually: put the files in place
.claude/commands/security-audit.mdCall it with /security-audit. For all projects use ~/.claude/commands/
Manually: put the files in place
~/.codex/prompts/security-audit.mdCall it with /prompts:security-audit. Codex marks this format deprecated in favour of skills
Manually: put the files in place
.github/prompts/security-audit.prompt.mdManually: put the files in place
.gemini/commands/security-audit.tomlGemini stores commands as TOML: the prompt text goes into the prompt field
Questions about security-audit
How do I install security-audit in Claude Code?
Run npx claude-code-templates@latest --command security/security-audit to save the command template to .claude/commands/security-audit.md.
What does the security-audit command do?
It reviews your project across ten security domains, including dependencies, secrets, input validation, and infrastructure. It then provides an executive summary with severity-rated findings and fix examples.
What arguments can I pass to security-audit?
You can pass --full for a complete review or supply a specific focus area, such as a component or security domain.
Source text
security-audit.md · MIT
---
allowed-tools: Read, Bash, Grep, Glob
argument-hint: "[focus-area] | --full"
description: Perform comprehensive security assessment and vulnerability analysis
---
# Security Audit
Perform comprehensive security assessment: $ARGUMENTS
## Current Environment
- Dependency scan: !`npm audit --audit-level=moderate 2>/dev/null || pip check 2>/dev/null || echo "No package manager detected"`
- Environment files: @.env* (if exists)
- Security config: @.github/workflows/security.yml or @security/ (if exists)
- Recent commits: !`git log --oneline --grep="security\|fix" -10`
## Task
Perform systematic security audit following these steps:
1. **Environment Setup**
- Identify the technology stack and framework
- Check for existing security tools and configurations
- Review deployment and infrastructure setup
2. **Dependency Security**
- Scan all dependencies for known vulnerabilities
- Check for outdated packages with security issues
- Review dependency sources and integrity
- Use appropriate tools: `npm audit`, `pip check`, `cargo audit`, etc.
3. **Authentication & Authorization**
- Review authentication mechanisms and implementation
- Check for proper session management
- Verify authorization controls and access restrictions
- Examine password policies and storage
4. **Input Validation & Sanitization**
- Check all user input validation and sanitization
- Look for SQL injection vulnerabilities
- Identify potential XSS (Cross-Site Scripting) issues
- Review file upload security and validation
5. **Data Protection**
- Identify sensitive data handling practices
- Check encryption implementation for data at rest and in transit
- Review data masking and anonymization practices
- Verify secure communication protocols (HTTPS, TLS)
6. **Secrets Management**
- Scan for hardcoded secrets, API keys, and passwords
- Check for proper secrets management practices
- Review environment variable security
- Identify exposed configuration files
7. **Error Handling & Logging**
- Review error messages for information disclosure
- Check logging practices for security events
- Verify sensitive data is not logged
- Assess error handling robustness
8. **Infrastructure Security**
- Review containerization security (Docker, etc.)
- Check CI/CD pipeline security
- Examine cloud configuration and permissions
- Assess network security configurations
9. **Security Headers & CORS**
- Check security headers implementation
- Review CORS configuration
- Verify CSP (Content Security Policy) settings
- Examine cookie security attributes
10. **Reporting**
- Document all findings with severity levels (Critical, High, Medium, Low)
- Provide specific remediation steps for each issue
- Include code examples and file references
- Create an executive summary with key recommendations
Use automated security scanning tools when available and provide manual review for complex security patterns.
© davila7 · MIT · davila7/claude-code-templates
