# esaa-security-audit

This skill runs 95 checks across 16 security domains and records every finding as an immutable event, so the same repo state yields the same report.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 717 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/esaa-security-audit/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/esaa-security-audit

## What it does

The audit is event-sourced. Each agent action lands as a separate event in `.roadmap/activity.jsonl`, and progress is projected from those events into `roadmap.json`. Replay the log against the same repository snapshot and you get the same findings — handy when someone asks where a report line came from.

Work moves through phases: reconnaissance (stack, architecture, data flows, attack surface), then domain checks from `playbooks/playbooks.security.json`, then risk classification and recommendations. Outputs go to `reports/phase1` through `reports/final`. Agents operate under `AGENT_CONTRACT.yaml` and `ORCHESTRATOR_CONTRACT.yaml`, and results are schema-validated, so a finding without a file and line does not make it into the report.

You need Python 3.9+ and LLM API access: an OpenAI or Anthropic key in your environment, plus the target repo path in `AUDIT_TARGET_REPO`. No key means the phases never start, so check that first.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill esaa-security-audit -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/esaa-security-audit/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/esaa-security-audit/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill esaa-security-audit -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/esaa-security-audit/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill esaa-security-audit -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/esaa-security-audit/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills esaa-security-audit
```

2. **Manually: put the files in place**
- File: `.github/skills/esaa-security-audit/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill esaa-security-audit -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/esaa-security-audit
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/esaa-security-audit/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill esaa-security-audit -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/esaa-security-audit/SKILL.md

## When to use it
- audit a repository across 16 security domains
- get a report with file and line evidence for each finding
- reproduce identical findings from the same code snapshot
- check AI-generated code for common vulnerabilities
- see which checks passed and which failed per domain

## Example prompts
- run a security audit of this repo with ESAA
- run the ESAA checks for the authentication domain and show failures
- generate a deterministic security report from the event store

## Similar
- [security-compliance-audit](https://affpapa.org/en/nevibecode/skills/security-compliance-audit.md) — skill · 665 installs
- [convex-security-audit](https://affpapa.org/en/nevibecode/skills/convex-security-audit.md) — skill · 1500 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/donchitos-security-audit.md) — skill · 416 installs
- [mcp-security-audit](https://affpapa.org/en/nevibecode/skills/mcp-security-audit.md) — skill · 1100 installs
- [supabase-security-audit](https://affpapa.org/en/nevibecode/commands/supabase-security-audit.md) — command · 1020 installs
- [skill-security](https://affpapa.org/en/nevibecode/skills/skill-security.md) — skill · 8000 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 42 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md