Skip to main content
affpapa.org
RU EN
skill CX Codex

esaa-security-audit — Claude Code skill: event-sourced security audit

This skill runs 95 checks across 16 security domains and records every finding as an immutable event, so the same repo state yields the same report.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill esaa-security-audit -a claude-code
Open on GitHub

What esaa-security-audit does

The audit is event-sourced. Each agent action lands as a separate event in .roadmap/activity.jsonl, and progress is projected from those events into roadmap.json. Replay the log against the same repository snapshot and you get the same findings — handy when someone asks where a report line came from.

Work moves through phases: reconnaissance (stack, architecture, data flows, attack surface), then domain checks from playbooks/playbooks.security.json, then risk classification and recommendations. Outputs go to reports/phase1 through reports/final. Agents operate under AGENT_CONTRACT.yaml and ORCHESTRATOR_CONTRACT.yaml, and results are schema-validated, so a finding without a file and line does not make it into the report.

You need Python 3.9+ and LLM API access: an OpenAI or Anthropic key in your environment, plus the target repo path in AUDIT_TARGET_REPO. No key means the phases never start, so check that first.

What it helps with

  • audit a repository across 16 security domains
  • get a report with file and line evidence for each finding
  • reproduce identical findings from the same code snapshot
  • check AI-generated code for common vulnerabilities
  • see which checks passed and which failed per domain

Example prompts for the agent

  • run a security audit of this repo with ESAA
  • run the ESAA checks for the authentication domain and show failures
  • generate a deterministic security report from the event store

How to install esaa-security-audit

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill esaa-security-audit -a claude-code

2Manually: put the files in place

~/.claude/skills/esaa-security-audit/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/esaa-security-audit/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about esaa-security-audit

How do I install esaa-security-audit in Claude?

Run npx skills add reason-machines/security-skills --skill esaa-security-audit -a claude-code. The skill lands at ~/.claude/skills/esaa-security-audit/SKILL.md.

What does esaa-security-audit do?

It executes 95 checks across 16 security domains and writes every audit event to an append-only log. The report is compiled from that log with evidence attached to each finding.

What do I need to run it?

Python 3.9+, LLM API access (Anthropic Claude, Anthropic Claude or compatible) and a readable target repository. Keys go in environment variables, the target path in AUDIT_TARGET_REPO.

Similar skills

All skills for Security →
security-compliance-audit aj-geddes A skill that walks through security compliance checks for SOC 2, GDPR, HIPAA, PCI-DSS and ISO 27001. Useful before certification or an annual audit. CX Codex +1 665installs convex-security-audit waynesutton A skill that walks through a Convex app's security and writes up what it finds. Useful before a launch or after an incident. CX Codex +1 1,500installs security-audit Donchitos This skill scans a game codebase for save tampering, cheat vectors, network exploits and input validation gaps. Run it before a public or multiplayer release. CX Codex +1 416installs mcp-security-audit official github Audits MCP server configurations for exposed secrets, shell injection, mutable package references, and unapproved servers. Use it before changing .mcp.json. 1,100installs supabase-security-audit davila7 A slash command that audits a Supabase project: RLS policies, role permissions, API keys and auth configuration, with a report at the end. 1,020installs skill-security superagent-ai Audits AI agent skills, plugins, and SKILL.md files for security risks and prompt injections before installation. CX Codex +1 8,000installs

From the same set17

malware-warning-bitdefender-crack Flags repositories that disguise malware as cracked Bitdefender software and helps explain the signals behind the threat. CX Codex +1 971installs malware-detection-and-removal A skill for spotting repositories that pose as cracked software and deciding what to do about them. CX Codex +1 952installs npm-security-best-practices Guides npm dependency hardening, supply-chain attack prevention, and safer package-manager settings. Useful when reviewing Node.js installs. CX Codex +1 919installs malware-repository-warning The skill triggers when someone asks for help with a crack, keygen or pre-activated antivirus, and answers with a warning instead of setup steps. CX Codex +1 851installs edgesecurityaccess-wireguard-vpn This skill walks the agent through standing up a WireGuard VPN: build the Go server, add users, and hand out configs over an HTTP API. CX Codex +1 788installs sparkfinderoven-security-compliance-skills A suite of commands and workflows for security and compliance work: OWASP scanning, CVE detection, GDPR audits, SOC 2 readiness, threat modeling. CX Codex +1 759installs pentestify-security-report-generator A skill that turns pentest findings into a structured report: vulnerability tracking, live risk stats and PDF export. CX Codex +1 747installs sparkfinderoven-r01-security-compliance-skills A skill suite that scans code for OWASP vulnerabilities, checks dependencies for CVEs, audits GDPR and SOC 2 readiness, and builds STRIDE threat models. CX Codex +1 729installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor