skills.rest
marinkobabic
marinkobabicCOMMUNITY
Explore all skills by this author →
GitHub

aif-security-checklist

Run OWASP Top 10 (2021)-aligned security audits for web applications.

Updated Apr 21, 2026
Search Tags:#owasp#security audit#vulnerability scan#injection prevention#secret scanning#web app security#pre-deployment check
One-click install
npx skills add https://github.com/marinkobabic/dario-shop --skill aif-security-checklist-marinkobabic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aif-security-checklist
Source: https://github.com/marinkobabic/dario-shop/tree/main/.claude/skills/aif-security-checklist
Command: npx skills add https://github.com/marinkobabic/dario-shop --skill aif-security-checklist-marinkobabic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Web application teams often lack a consistent, structured process for security reviews, leading to missed OWASP Top 10 vulnerabilities, hardcoded secrets, and misconfigurations that only surface after production incidents. This Skill eliminates ad-hoc, incomplete security checks by providing a standardized, comprehensive audit workflow aligned with industry best practices.

Core Features & Use Cases

  • Categorized Security Checklists: Guided checklists for every OWASP Top 10 (2021) risk category, including authentication, injection, XSS, CSRF, secrets management, API security, infrastructure, LLM prompt injection, and race conditions.
  • Automated Scanning: A built-in bash script that automatically detects hardcoded secrets, untracked .env files, high-severity npm vulnerabilities, leftover debug logs, and unfinished security TODOs.
  • Use Case: A team preparing to deploy a new e-commerce storefront can run the full audit to verify no admin credentials are hardcoded, all protected routes have authentication, and dependencies have no critical vulnerabilities, or run a targeted check for CSRF risks specific to their SPA architecture.

Quick Start

Invoke the aif-security-checklist skill to run a full security audit of your web application before deployment, or run a targeted check for a specific risk category such as injection or secrets management.

Frequently Asked Questions about aif-security-checklist

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a pre-deployment security audit for a web application?▼

Run a pre-deployment security audit by executing an OWASP Top 10 (2021)-aligned workflow that combines automated vulnerability scanning for hardcoded secrets and npm dependencies with guided manual checklists for critical controls like authentication, XSS, and CSRF protection.

Can I run a targeted vulnerability scan for just injection prevention instead of a full audit?▼

Yes, you can run a targeted vulnerability scan for injection prevention. The audit workflow supports category-specific checks, allowing you to isolate and evaluate individual OWASP Top 10 risks like injection, API security, or LLM prompt injection without executing a full audit.

What does an automated web app vulnerability scanner detect?▼

An automated web app vulnerability scanner detects hardcoded secrets, untracked .env files, high-severity npm dependency vulnerabilities, leftover debug logs, and unfinished security TODOs by running a built-in bash script against your codebase.

Does this security audit cover LLM prompt injection and race condition risks?▼

Yes, the security audit covers LLM prompt injection and race condition risks. The structured checklists explicitly include these modern web application threats alongside traditional OWASP Top 10 categories like authentication, API security, and infrastructure configuration.

How do I handle project-specific ignored risk items during an OWASP security review?▼

Handle project-specific ignored risk items by configuring the audit workflow to exclude specific security checks. This allows teams to skip irrelevant OWASP categories or suppress known false positives while still maintaining a structured compliance review for remaining vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
adnanmuelleradnanmueller
2

security-audit

Validate security controls and generate a deployment readiness report.

Community
Advanced
statick88statick88
1

vulnerability-scanning

Automate vulnerability detection across code, dependencies, containers, and infrastructure.

Community
Advanced
linardsblinardsb

security-engineering

Assess vulnerabilities and verify compliance across cloud and application systems.

Community
Advanced