security-audit · netresearch — Claude Code skill: security audits for your project
A skill that walks an agent through security reviews of code, infrastructure and AI agent configs using OWASP, CWE and CVSS. Useful before a release or when reading an unfamiliar codebase.
npx skills add netresearch/security-audit-skill --skill security-audit -a claude-codeWhat security-audit does
The skill supplies audit patterns: OWASP Top 10, LLM Top 10 2025, CWE Top 25 2025 and CVSS v3.1/v4.0 scoring. It covers the usual holes — XXE, SQLi, XSS, CSRF, command injection, path traversal, file uploads, deserialization, SSRF, JWT and type juggling.
PHP and TYPO3 get the most attention: more than 80 checkpoints, with typo3-security.md covering v14.3 LTS. Separate reference files deal with AWS, Terraform, Kubernetes, Docker and Helm, with REST/GraphQL, CSP and DOM-XSS, and with agent configs — SKILL.md, AGENTS.md, CLAUDE.md, mcp.json, hooks.json — including prompt injection and excessive agency. You also get a checklist and three scripts: a dispatcher that reads indicator files, picks the right scanner from 13 ecosystems, plus a PHP-only run and a GitHub repository check.
It needs grep, jq and gh CLI; without them the scripts fall over. No scanner ships inside the skill, so the checklist lines about semgrep, trivy and gitleaks assume you install those yourself. On GitHub Actions the skill forbids putting ${{ inputs.* }} or ${{ github.event.* }} straight into run: — pass values through env: instead.
What it helps with
- sweep a PHP project for common flaws before release
- check agent configs for prompt injection and excess permissions
- score findings with CVSS and decide what to fix first
- hunt for leaked secrets in git history
- review Terraform and Kubernetes manifests for weak spots
Example prompts for the agent
- Run a security audit on
/path/to/projectand list findings by OWASP Top 10 - Check
CLAUDE.mdandmcp.jsonfor prompt injection and excessive agency - Score these findings with CVSS v4.0 and tell me what to fix first
How to install security-audit
1Skills CLI (Vercel)
npx skills add netresearch/security-audit-skill --skill security-audit -a claude-code2Manually: put the files in place
~/.claude/skills/security-audit/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-audit/
1Skills CLI (Vercel)
npx skills add netresearch/security-audit-skill --skill security-audit -a codex2Manually: put the files in place
.agents/skills/security-audit/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add netresearch/security-audit-skill --skill security-audit -a cursor2Manually: put the files in place
.cursor/skills/security-audit/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install netresearch/security-audit-skill security-audit2Manually: put the files in place
.github/skills/security-audit/SKILL.md1Skills CLI (Vercel)
npx skills add netresearch/security-audit-skill --skill security-audit -a gemini-cli2Platform CLI
gemini skills install https://github.com/netresearch/security-audit-skill --path skills/security-auditManually: put the files in place
.devin/skills/security-audit/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add netresearch/security-audit-skill --skill security-audit -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about security-audit
How to install security-audit in Claude Code?
Run npx skills add netresearch/security-audit-skill --skill security-audit -a claude-code, then confirm the skill file sits at ~/.claude/skills/security-audit/SKILL.md.
What does security-audit do?
It guides an agent through security reviews: check patterns for code, APIs, frontend, infrastructure and AI agent configs, plus a checklist and scanner scripts.
What do I need for the skill to work?
grep, jq and gh CLI. External scanners such as semgrep, trivy and gitleaks are not bundled — install them separately to cover those checklist items.
Similar skills
All skills for Security →security-audit by other authors comes first.
