Agent skill · security · aiskillstore
security-audit
Security review guidance and domain checklists based on NIST, CIS, OWASP, MITRE ATT&CK, SLSA, and OpenSSF frameworks.
Why this skill is useful
Provides detailed security audit checklists and methodologies based on established frameworks that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Security Researcher Senior-grade security review guidelines anchored on canonical control frameworks: NIST CSF 2.0, CIS Controls v8, NIST SSDF, OWASP ASVS, OWASP Top 10, MITRE ATT&CK, SLSA, and OpenSSF Scorecard. When to Use Security review or audit of code, architecture, or infrastructure Threat modeling sessions Reviewing PRs for security implications Assessing supply chain security Smart contract or ZK circuit security reviews Frameworks Reference Framework Purpose -------------------- ----------------------------- NIST CSF 2.0 Org-wide risk outcomes CIS Controls v8 Practical enterprise controls NIST SSDF SP 800-218 Secure development lifecycle OWASP ASVS App security requirements OWASP Top 10 (2025) Common web app failures MITRE ATT&CK Adversary techniques mapping SLSA + OpenSSF Supply chain integrity Non-Negotiables Before any deep review, verify these fundamentals: 1. Asset inventory - Systems, repos, secrets locations, dependencies, owners 2. MFA everywhere - Hardware keys for admins, no shared accounts 3. Patch management - Continuous vuln scanning (OS, containers, deps) 4. Centralized logging - Auth, privilege changes, egress, CI/CD, key access 5. Tested backups - Restore drills, immutable where possible 6. Incident response - Runbooks, on-call, break-glass procedures Review Methodology 1. Threat Model First Use STRIDE categories: Spoofing - Can attacker impersonate? Tampering - Can data be modified? Repudiation - Can actions be denied? Information disclosure - Data leaks? Denial of service - Availability attacks? Elevation of privilege - Unauthorized access? Document for each trust boundary: Auth strategy Data classification Rate limits Audit requirements Assume compromise review: If one service key leaks, what's the blast radius? If one dependency is malicious, what stops it? 2. Identity & Access (Root Cause #1) Broken access control is the most common vulnerability. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/security-audit--bbe78b