# security-audit

A workflow skill that walks a web app or API through recon, vulnerability scanning, pentesting, hardening and reporting.

- skill · `type=skill` · Claude Code · 673 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/security-audit
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/security-audit

## What it does

The skill runs an audit in phases instead of firing one scanner at the target. Recon comes first: define scope, gather intelligence, map the attack surface. Then automated scanning, static analysis and a dependency check. After that come web app and API testing, penetration testing, hardening, and the report.

Each phase pulls in other skills — `scanning-tools`, `shodan-reconnaissance`, `top-web-vulnerabilities`, `vulnerability-scanner`, `sql-injection-testing`, `xss-html-injection`, `broken-authentication`, `idor-testing`, `file-path-traversal`, `burp-suite-testing`, `api-fuzzing-bug-bounty`, `pentest-commands`, `metasploit-framework`, `security-scanning-security-hardening`, `reporting-standards`. That is a lot of moving parts. If those skills are not present in your setup, some phases have nothing to call, so install them alongside this one.

Checklists for the OWASP Top 10 and API security ship with it, plus quality gates: every planned test executed, findings written up, proof of concept captured, risk assessed, remediation steps listed. Related bundles named in the workflow are `development`, `wordpress`, `cloud-devops` and `testing-qa`.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/security-audit
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill security-audit -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/security-audit/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-audit/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/security-audit/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/security-audit/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates security-audit
```

2. **Manually: put the files in place**
- File: `.github/skills/security-audit/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/security-audit
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-audit/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/security-audit

## When to use it
- map the attack surface before touching the app
- find OWASP Top 10 flaws in a web application
- test API auth, rate limits and input validation
- audit dependencies for known vulnerabilities
- produce a report with risk levels and fixes

## Example prompts
- Run initial recon on our domain with `@scanning-tools`
- Test the API for injection and broken authentication
- Write up the findings with remediation steps

## Similar
- [security-pen-testing](https://affpapa.org/en/nevibecode/skills/security-pen-testing.md) — skill · 834 installs
- [vulnerability-scanning](https://affpapa.org/en/nevibecode/skills/vulnerability-scanning.md) — skill · 611 installs
- [api-audit](https://affpapa.org/en/nevibecode/skills/api-audit.md) — skill · 482 installs
- [owasp-security](https://affpapa.org/en/nevibecode/skills/owasp-security.md) — skill · 3000 installs
- [owasp-security-check](https://affpapa.org/en/nevibecode/skills/owasp-security-check.md) — skill · 1700 installs
- [backend-security-coder](https://affpapa.org/en/nevibecode/skills/backend-security-coder.md) — skill · 1000 installs

## Other versions with the same name
- [security-audit · cloudflare](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — 54800 installs
- [security-audit · donchitos](https://affpapa.org/en/nevibecode/skills/donchitos-security-audit.md) — 416 installs
- [security-audit · decebals](https://affpapa.org/en/nevibecode/skills/decebals-security-audit.md) — 309 installs
- [security-audit · netresearch](https://affpapa.org/en/nevibecode/skills/netresearch-dtt-gmbh-security-audit.md) — 698 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md