skill

security-audit · davila7 — Claude Code skill: phased security audit workflow

Q: How do I install security-audit in Claude Code?

Use the templates CLI: `npx claude-code-templates@latest --skill security/security-audit`. Or install from the repo: `npx skills add davila7/claude-code-templates --skill security-audit -a claude-code`.

Q: What does the skill need to run?

It invokes other skills such as `scanning-tools`, `vulnerability-scanner`, `sql-injection-testing` and `metasploit-framework`. Without them the matching phases have nothing to call.

A workflow skill that walks a web app or API through recon, vulnerability scanning, pentesting, hardening and reporting.

Install into Claude Code · claude-code-templates All methods and platforms ↓

npx claude-code-templates@latest --skill security/security-audit

Open on GitHub

What security-audit does

The skill runs an audit in phases instead of firing one scanner at the target. Recon comes first: define scope, gather intelligence, map the attack surface. Then automated scanning, static analysis and a dependency check. After that come web app and API testing, penetration testing, hardening, and the report.

Each phase pulls in other skills — scanning-tools, shodan-reconnaissance, top-web-vulnerabilities, vulnerability-scanner, sql-injection-testing, xss-html-injection, broken-authentication, idor-testing, file-path-traversal, burp-suite-testing, api-fuzzing-bug-bounty, pentest-commands, metasploit-framework, security-scanning-security-hardening, reporting-standards. That is a lot of moving parts. If those skills are not present in your setup, some phases have nothing to call, so install them alongside this one.

Checklists for the OWASP Top 10 and API security ship with it, plus quality gates: every planned test executed, findings written up, proof of concept captured, risk assessed, remediation steps listed. Related bundles named in the workflow are development, wordpress, cloud-devops and testing-qa.

What it helps with

map the attack surface before touching the app
find OWASP Top 10 flaws in a web application
test API auth, rate limits and input validation
audit dependencies for known vulnerabilities
produce a report with risk levels and fixes

Example prompts for the agent

Run initial recon on our domain with @scanning-tools
Test the API for injection and broken authentication
Write up the findings with remediation steps

How to install security-audit

1claude-code-templates

npx claude-code-templates@latest --skill security/security-audit

2Skills CLI (Vercel)

npx skills add davila7/claude-code-templates --skill security-audit -a claude-code

3Manually: put the files in place

~/.claude/skills/security-audit/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/security-audit/

Manually: put the files in place

.agents/skills/security-audit/SKILL.md

For all projects use ~/.agents/skills/

Manually: put the files in place

.cursor/skills/security-audit/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install davila7/claude-code-templates security-audit

2Manually: put the files in place

.github/skills/security-audit/SKILL.md

Platform CLI

gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/security-audit

Manually: put the files in place

.devin/skills/security-audit/SKILL.md

The legacy .windsurf/skills/ path still works

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about security-audit

How do I install security-audit in Claude Code?

Use the templates CLI: npx claude-code-templates@latest --skill security/security-audit. Or install from the repo: npx skills add davila7/claude-code-templates --skill security-audit -a claude-code.

What does security-audit do?

It drives a security audit through phases: reconnaissance, vulnerability scanning, web app and API testing, penetration testing, hardening, and reporting.

What does the skill need to run?

It invokes other skills such as scanning-tools, vulnerability-scanner, sql-injection-testing and metasploit-framework. Without them the matching phases have nothing to call.

Similar skills

All skills for Security →

security-audit by other authors comes first.

security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-audit Donchitos This skill scans a game codebase for save tampering, cheat vectors, network exploits and input validation gaps. Run it before a public or multiplayer release. CX Codex +1 416installs security-audit decebals An OWASP Top 10 checklist for Java code: input validation, SQL injection, XSS and security headers. Useful before a release or when reviewing auth code. CX Codex +1 309installs security-audit Netresearch DTT GmbH A skill that walks an agent through security reviews of code, infrastructure and AI agent configs using OWASP, CWE and CVSS. Useful before a release or when reading an unfamiliar codebase. CX Codex +1 698installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set361

The whole set →

planning Keeps markdown files for goals, findings and session progress so an agent doesn't drift off the task mid-run. 712installs context7-auto-research This skill retrieves current library and framework references through the Context7 API. Use it when a Claude Code answer needs documentation for React, Next.js, Prisma, or another library. 709installs nextjs-performance-audit This command checks a Next.js project’s Lighthouse results, bundle size, and runtime performance. Use it to find performance issues and get optimization suggestions. 694installs figma-implement-design Turns a Figma node into code that fits your project: pulls the design context, a screenshot and assets over Figma MCP, then maps them onto your components and tokens. 689installs moc-agent A Claude subagent that builds and maintains maps of content (MOCs) in an Obsidian vault. Useful once notes pile up in folders with no navigation. 666installs performance-audit Audits codebase performance, locating slow database queries, nested loops, and build bottlenecks. Prioritizes optimizations by system impact and implementation effort. 661installs dependency-audit Audits project dependencies for known CVEs, license compliance issues, and outdated packages across multiple ecosystems. 658installs setup-development-environment A slash command that builds out a dev environment: runtimes, tooling, build setup, linters, configs. Handy when you spin up a project on a fresh machine. 651installs