auditing-security — Claude Code skill: what it does, how to install
Audits codebases for hardcoded secrets, OWASP Top 10 flaws, and insecure settings. Helps spot security risks before shipping code.
npx skills add spencerpauly/awesome-cursor-skills --skill auditing-security -a claude-codeWhat auditing-security does
The skill runs audits across seven steps. First, the model searches for committed credentials, AWS or Stripe tokens, and unignored .env files. It then examines authentication logic, password hashing algorithms, and injection risks like raw SQL queries, template rendering, and child_process.exec() calls.
The review also inspects dependencies using npm audit or pip audit, checks CORS and CSP headers, and looks for sensitive fields leaking in API responses or logs. Findings are compiled into a report grouped by Critical, High, Medium, and Low severity, complete with file paths, line numbers, and fixes.
This is a code review, not a penetration test. Finding live deployment vulnerabilities requires tools like trivy or snyk.
What it helps with
- Scan files for committed API keys, tokens, and credentials
- Detect SQL injections, XSS sinks, and command execution flaws
- Verify CORS headers, CSP policies, and session cookie flags
- Generate a vulnerability report with file paths and severity ratings
Example prompts for the agent
- Audit the security of this codebase and check for OWASP vulnerabilities
- Review our authentication and authorization logic for security flaws
- Perform a security audit and produce a report with severity ratings
How to install auditing-security
1Skills CLI (Vercel)
npx skills add spencerpauly/awesome-cursor-skills --skill auditing-security -a claude-code2Manually: put the files in place
~/.claude/skills/auditing-security/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/auditing-security/
1Skills CLI (Vercel)
npx skills add spencerpauly/awesome-cursor-skills --skill auditing-security -a codex2Manually: put the files in place
.agents/skills/auditing-security/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add spencerpauly/awesome-cursor-skills --skill auditing-security -a cursor2Manually: put the files in place
.cursor/skills/auditing-security/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install spencerpauly/awesome-cursor-skills auditing-security2Manually: put the files in place
.github/skills/auditing-security/SKILL.md1Skills CLI (Vercel)
npx skills add spencerpauly/awesome-cursor-skills --skill auditing-security -a gemini-cli2Platform CLI
gemini skills install https://github.com/spencerpauly/awesome-cursor-skills --path resources/auditing-securityManually: put the files in place
.devin/skills/auditing-security/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add spencerpauly/awesome-cursor-skills --skill auditing-security -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about auditing-security
How to install auditing-security in Claude Code?
Run npx skills add spencerpauly/awesome-cursor-skills --skill auditing-security -a claude-code. The file will be placed in ~/.claude/skills/auditing-security/SKILL.md.
What does the auditing-security skill do?
It guides the agent through checking source code for OWASP Top 10 risks, exposed secrets, flawed auth logic, and weak HTTP headers.
Does auditing-security replace penetration testing?
No, it performs static code analysis rather than runtime penetration tests. For live security checks, the skill suggests tools like trivy, snyk, and the OWASP Testing Guide.
Source text
SKILL.md · CC0-1.0
--- name: auditing-security description: Perform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns. --- # Security Audit Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application. ## Steps 1. **Scan for hardcoded secrets** — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like: - `password=`, `secret=`, `token=`, `api_key=` - Base64-encoded credentials - AWS keys (`AKIA...`), Stripe keys (`sk_live_...`), GitHub tokens (`ghp_...`) - Files: `.env` committed to git, `config.json` with credentials 2. **Check authentication & authorization** - Verify all API routes check authentication before processing. - Ensure role-based access control is enforced server-side, not just in the UI. - Check that password hashing uses bcrypt/argon2 (not MD5/SHA1). - Verify session tokens are HTTP-only, secure, and have reasonable expiry. 3. **Check for injection vulnerabilities** - **SQL injection**: look for string concatenation in SQL queries instead of parameterized queries. - **XSS**: look for `dangerouslySetInnerHTML`, `innerHTML`, or unescaped user input rendered in templates. - **Command injection**: look for `exec()`, `eval()`, `child_process.exec()` with user input. - **Path traversal**: check file operations for unsanitized user input in paths. 4. **Review dependency security** - Run `npm audit` or `pip audit` to check for known vulnerabilities. - Flag outdated dependencies with known CVEs. - Check for overly permissive dependency ranges. 5. **Check CORS and CSP configuration** - Verify CORS doesn't use `Access-Control-Allow-Origin: *` in production. - Check for Content Security Policy headers. - Verify `X-Frame-Options`, `X-Content-Type-Options`, and `Strict-Transport-Security` headers. 6. **Review data exposure** - Check API responses for leaking sensitive fields (password hashes, internal IDs, PII). - Verify error messages don't expose stack traces or internal details in production. - Check logging for sensitive data being written to logs. 7. **Generate report** — produce a summary with severity ratings (Critical / High / Medium / Low) for each finding, with the file path, line number, and recommended fix. ## Notes - This is a code review, not a penetration test. Recommend tools like `npm audit`, `trivy`, or `snyk` for automated scanning. - Always check `.gitignore` to ensure `.env`, credentials, and key files are excluded. - For comprehensive auditing, recommend the OWASP Testing Guide.
© spencerpauly · CC0-1.0 · spencerpauly/awesome-cursor-skills
