# security-audit

A skill that walks an agent through security reviews of code, infrastructure and AI agent configs using OWASP, CWE and CVSS. Useful before a release or when reading an unfamiliar codebase.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 698 installs · ★ 48
- Author: Netresearch DTT GmbH
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/netresearch/security-audit-skill/tree/HEAD/skills/security-audit/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/netresearch-dtt-gmbh-security-audit

## What it does

The skill supplies audit patterns: OWASP Top 10, LLM Top 10 2025, CWE Top 25 2025 and CVSS v3.1/v4.0 scoring. It covers the usual holes — XXE, SQLi, XSS, CSRF, command injection, path traversal, file uploads, deserialization, SSRF, JWT and type juggling.

PHP and TYPO3 get the most attention: more than 80 checkpoints, with `typo3-security.md` covering v14.3 LTS. Separate reference files deal with AWS, Terraform, Kubernetes, Docker and Helm, with REST/GraphQL, CSP and DOM-XSS, and with agent configs — `SKILL.md`, `AGENTS.md`, `CLAUDE.md`, `mcp.json`, `hooks.json` — including prompt injection and excessive agency. You also get a checklist and three scripts: a dispatcher that reads indicator files, picks the right scanner from 13 ecosystems, plus a PHP-only run and a GitHub repository check.

It needs `grep`, `jq` and `gh CLI`; without them the scripts fall over. No scanner ships inside the skill, so the checklist lines about `semgrep`, `trivy` and `gitleaks` assume you install those yourself. On GitHub Actions the skill forbids putting `${{ inputs.* }}` or `${{ github.event.* }}` straight into `run:` — pass values through `env:` instead.

## Requirements
- Works with: AWS, Docker, Kubernetes

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add netresearch/security-audit-skill --skill security-audit -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/security-audit/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-audit/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add netresearch/security-audit-skill --skill security-audit -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/security-audit/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add netresearch/security-audit-skill --skill security-audit -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/security-audit/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install netresearch/security-audit-skill security-audit
```

2. **Manually: put the files in place**
- File: `.github/skills/security-audit/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add netresearch/security-audit-skill --skill security-audit -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/netresearch/security-audit-skill --path skills/security-audit
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-audit/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add netresearch/security-audit-skill --skill security-audit -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/netresearch/security-audit-skill/tree/HEAD/skills/security-audit/SKILL.md

## When to use it
- sweep a PHP project for common flaws before release
- check agent configs for prompt injection and excess permissions
- score findings with CVSS and decide what to fix first
- hunt for leaked secrets in git history
- review Terraform and Kubernetes manifests for weak spots

## Example prompts
- Run a security audit on `/path/to/project` and list findings by OWASP Top 10
- Check `CLAUDE.md` and `mcp.json` for prompt injection and excessive agency
- Score these findings with CVSS v4.0 and tell me what to fix first

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

## Other versions with the same name
- [security-audit · cloudflare](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — 54800 installs
- [security-audit · donchitos](https://affpapa.org/en/nevibecode/skills/donchitos-security-audit.md) — 416 installs
- [security-audit · decebals](https://affpapa.org/en/nevibecode/skills/decebals-security-audit.md) — 309 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md