Agent skill · security · aiskillstore
security-audit
Detect common security vulnerabilities in code. Covers OWASP patterns, SQL injection, bare excepts, shell injection. Framework-agnostic.
Why this skill is useful
Provides detailed patterns and remediation strategies for common security vulnerabilities that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Security Audit Skill Detect common security vulnerabilities during code review and development. Based on OWASP guidelines and common vulnerability patterns. Design Principle This skill is framework-generic. It provides universal security patterns: Covers OWASP Top 10 and common CWEs Works with Python, TypeScript, and other languages Project-specific security requirements go in project-specific skills Variables Variable Default Description ---------- --------- ------------- SEVERITYTHRESHOLD medium Minimum severity to report SCANDEPTH 3 Directory depth for scanning INCLUDETESTS false Include test files in scan Instructions MANDATORY - Follow the Workflow steps below in order. 1. Identify security-sensitive code areas 2. Check for common vulnerability patterns 3. Report findings with severity 4. Suggest remediation Red Flags - STOP and Reconsider If you're about to: Write SQL with string concatenation Use bare except: blocks Execute shell commands with user input Store secrets in code Disable security features "temporarily" STOP -> Use parameterized queries -> Add specific exception handling -> Then proceed Cookbook SQL Injection Prevention IF: Writing database queries THEN: Read and execute ./cookbook/sql-injection.md Bare Except Handling IF: Writing exception handlers THEN: Read and execute ./cookbook/bare-except.md Shell Injection Prevention IF: Executing shell commands THEN: Read and execute ./cookbook/shell-injection.md Vulnerability Patterns SQL Injection (CWE-89) BAD - String concatenation: GOOD - Parameterized queries: Bare Except (CWE-754) BAD - Catches everything: GOOD - Specific exceptions: Shell Injection (CWE-78) BAD - User input in shell: GOOD - Avoid shell, use lists: Path Traversal (CWE-22) BAD - User input in paths: GOOD - Validate and sanitize: Hardcoded Secrets (CWE-798) BAD - Secrets in code: GOOD - Environment variables: XSS (CWE-79) BAD - Unsanitized output: GOOD - Proper escaping: Severity Levels Severity Impact Examples ---------- -------- ---- …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/security-audit--352e02