ai-factory.security-checklist

Name: ai-factory.security-checklist
Availability: InStock
Author: spraby

Audit web applications for OWASP Top 10 vulnerabilities using bash scripts.

Updated Mar 31, 2025

Search Tags:#code review #checklist #security #vulnerability #owasp #audit

Ready to run

npx skills add https://github.com/spraby/api --skill ai-factory-security-checklist-spraby

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ai-factory.security-checklist
Source: https://github.com/spraby/api/tree/main/.claude/skills/security-checklist
Command: npx skills add https://github.com/spraby/api --skill ai-factory-security-checklist-spraby

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps developers and security professionals identify and remediate common security vulnerabilities in their codebases, ensuring applications are robust and protected against threats.

Core Features & Use Cases

Comprehensive Audit: Covers OWASP Top 10, authentication, injection, XSS, CSRF, secrets management, API security, and infrastructure best practices.
Automated Checks: Includes scripts for finding hardcoded secrets, checking dependency vulnerabilities, and identifying insecure configurations.
Use Case: Before deploying a new feature, run this Skill to perform a thorough security review, catching potential issues like exposed API keys or unvalidated user input.

Quick Start

Run the automated security audit script by typing bash ~/.claude/skills/security-checklist/scripts/audit.sh.

Frequently Asked Questions about ai-factory.security-checklist

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run an automated security audit for web application vulnerabilities?▼

Run an automated security audit by executing the bash audit script to perform static analysis. It identifies hardcoded secrets, dependency vulnerabilities, and insecure configurations while checking for OWASP Top 10 issues like injection flaws and XSS.

What does the OWASP Top 10 security checklist cover for code review?▼

An OWASP Top 10 security checklist covers authentication, injection flaws, XSS, CSRF, secrets management, API security, and infrastructure misconfigurations. It provides a comprehensive framework to identify and remediate common web application vulnerabilities during code review.

Can I detect hardcoded secrets and API keys in my codebase before deployment?▼

Yes, you can detect hardcoded secrets and exposed API keys by running automated grep-based static analysis scripts. These scripts scan your codebase to identify sensitive credentials and insecure configurations before you deploy new features.

Does this security audit tool require any external dependencies or frameworks?▼

No external dependencies are required. The security audit utilizes standard bash scripting, grep, and npm audit to perform static analysis and vulnerability detection directly on your codebase without needing additional frameworks or tools.

What is the best way to check npm dependency vulnerabilities during a security review?▼

The best way to check npm dependency vulnerabilities is by running npm audit within an automated bash script. This checks your project dependencies against known vulnerability databases to identify security issues before deployment.

Why should I use a bash script for static analysis instead of a dedicated security scanner?▼

Using a bash script for static analysis provides a lightweight, dependency-free approach to vulnerability detection. It leverages grep and npm audit to quickly identify hardcoded secrets, injection flaws, and insecure configurations without installing heavy dedicated security scanning tools.