skills.rest
letuhao
letuhaoCOMMUNITY
Explore all skills by this author →
GitHub

aif-security-checklist

Audit codebases against OWASP Top 10 security checks and track ignored findings.

31|2|Updated Mar 21, 2026
Search Tags:#code review#vulnerability#owasp#pre-deployment#security audit#secrets management#prompt injection
One-click install
npx skills add https://github.com/letuhao/lore-weave --skill aif-security-checklist-letuhao
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aif-security-checklist
Source: https://github.com/letuhao/lore-weave/tree/main/.cursor/skills/aif-security-checklist
Command: npx skills add https://github.com/letuhao/lore-weave --skill aif-security-checklist-letuhao

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Before deploying an application, developers need a systematic way to verify that authentication, injection prevention, XSS/CSRF protection, secrets management, and other critical security controls are actually in place. This Skill provides a structured OWASP Top 10-based audit workflow with automated checks and persistent tracking of intentionally ignored items. ## Core Features & Use Cases - Category-scoped audits: Run full audits or target specific areas like auth, injection, XSS, CSRF, secrets, API security, infrastructure, prompt injection, or race conditions. - Automated audit script: A bash script scans for hardcoded secrets, tracked .env files, vulnerable npm dependencies, verbose console logging, and raw error rendering patterns. - Ignored-item governance: Record accepted risks in a SECURITY.md artifact with reasons and dates, so audits skip them while keeping the team aware. - Machine-readable gate results: Every audit appends a structured pass/warn/fail JSON block for CI or workflow gating. - Use Case: Before a production release, run a full audit to catch a missing CSRF token and an exposed API key, then formally ignore the rate-limiting check because the service sits behind an API gateway. ## Quick Start Ask the AI to run a security audit on this project before deployment and report any critical findings.

Frequently Asked Questions about aif-security-checklist

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit before deploying my app?▼

Invoke the full audit to check authentication, injection, XSS, CSRF, secrets, API, and infrastructure controls against OWASP Top 10. An automated bash script also scans for hardcoded secrets, tracked .env files, npm vulnerabilities, and unsafe logging patterns.

How do I check only one security area like authentication or injection?▼

Pass a category argument such as auth, injection, xss, csrf, secrets, api, infra, prompt-injection, or race-condition to scope the audit. Only the checks for that category run, and the gate result reflects that scope.

How do I ignore a security check my team has accepted?▼

Use the ignore flow with a short kebab-case item ID like no-csrf. The Skill asks for a reason, then records the item with date and author in the SECURITY.md artifact so future audits skip it but still display it in an Ignored Items section.

Does the audit cover LLM prompt injection risks?▼

Yes, a dedicated prompt-injection category checks whether user input is concatenated into system prompts, whether LLM output is treated as untrusted, and whether tool calls are validated and sandboxed. Detailed patterns are in the references directory.

What does the audit script check automatically?▼

The bash script checks for hardcoded secrets in source files, .env tracked in git, .gitignore coverage, npm audit vulnerabilities, verbose console logging in production code, raw error rendering patterns, and security TODO markers.

What are the limitations of this security checklist?▼

It performs static pattern checks and manual review guidance, not dynamic penetration testing or runtime analysis. Findings rely on grep-based detection and reviewer judgment, so complex business-logic flaws may require dedicated security tooling.

Related Skills

Explore More Software Engineering Skills→
mafvietnammafvietnam

ck:security-scan

Scan codebases for vulnerabilities, secrets, and dependency risks.

Community
Advanced
dthuy62dthuy62

ck:security-scan

Scan codebases for exposed secrets and security vulnerabilities.

Community
Intermediate
Rune-kitRune-kit
82

sentinel

Scan code commits for secrets, OWASP top 10 patterns, and dependency vulnerabilities.

Official
Advanced
DCx7C5DCx7C5

pentest-SKILL.md

Identify and exploit security weaknesses in iOS and Android apps via OWASP MASTG.

Community
Advanced