skills.rest
fartybobo
fartyboboOFFICIAL
Explore all skills by this author →
WebsiteGitHub

audit-security

Audit code reviews for OWASP Top 10:2025, ASVS 5.0, and Agentic AI security vulnerabilities.

4|5|Updated Feb 20, 2026
Search Tags:#input-validation#access-control#security-review#code-safety#owasp-top-10#asvs-5.0#agentic-ai-security
One-click install
npx skills add https://github.com/fartybobo/farty-bobo --skill audit-security-fartybobo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-security
Source: https://github.com/fartybobo/farty-bobo/tree/main/skills/audit-security
Command: npx skills add https://github.com/fartybobo/farty-bobo --skill audit-security-fartybobo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill brings OWASP Top 10:2025, ASVS 5.0, and Agentic AI security guidance into every code review so authentication, authorization, input handling, error responses, and AI agent behavior are assessed with the same rigor as formal security audits.

Core Features & Use Cases

  • OWASP Top 10:2025 alignment: Follow the updated OWASP categories to catch broken access control, injection, misconfigurations, logging gaps, and other critical web application risks.
  • ASVS 5.0 and Agentic AI coverage: Differentiate requirements across Level 1 through Level 3, enforce password, session, and cryptographic controls, and apply agentic safety checks for goal hijacks, tool misuse, and rogue agents.
  • Language-specific footguns and mindset: Reference the key pitfalls for JavaScript, Python, Java, C#, PHP, Go, Ruby, Rust, Swift, Kotlin, C/C++, Scala, R, Perl, Shell, Lua, Elixir, Dart, PowerShell, SQL, and any other language you encounter to avoid known CVEs and memory or serialization traps.
  • Use Case: When reviewing a new API endpoint or AI agent workflow, run through the checklists to validate sanitization, scoped credentials, fail-closed logic, and secure deployment practices before approving the merge.

Quick Start

Apply the OWASP Top 10:2025, ASVS 5.0, and Agentic AI security checklists to the targeted code review before merging.

Frequently Asked Questions about audit-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my code for OWASP Top 10 vulnerabilities during a code review?▼

To check for OWASP Top 10 vulnerabilities during code review, apply the OWASP Top 10:2025 and ASVS 5.0 checklists to assess authentication, authorization, input handling, and error responses for injection and broken access control risks.

What is the best way to audit agentic AI workflows for security risks?▼

Auditing agentic AI workflows involves applying specific agentic safety checks to detect goal hijacks, tool misuse, and rogue agents, while enforcing scoped credentials and least-privilege execution throughout the AI pipeline assessment.

Can I use ASVS 5.0 to enforce password and session controls in my API?▼

Yes, you can use ASVS 5.0 to enforce password, session, and cryptographic controls in your API by differentiating security requirements across Levels 1 through 3 during your standard code review process.

How do I validate input sanitization and fail-closed error handling before merging code?▼

To validate input sanitization and fail-closed error handling before merging, run through security checklists that enforce strict input validation, scoped credentials, and secure deployment practices for the targeted web application or API endpoint.

Does this security review cover language-specific pitfalls for Python and JavaScript?▼

Yes, the security review covers language-specific pitfalls for Python, JavaScript, and many other languages, referencing known CVEs, memory traps, and serialization footguns to prevent vulnerabilities during the code assessment.

When should I apply least-privilege execution guidance in application security audits?▼

You should apply least-privilege execution guidance in application security audits whenever assessing authentication, authorization, or AI agent behavior, ensuring scoped credentials and fail-closed logic are enforced before approving any code merge.

Related Skills

Explore More Software Engineering Skills→
syhyasyhya
19

code-analysis

Analyze Python source code for bugs, vulnerabilities, and performance bottlenecks.

Community
Advanced
Kaikei-eKaikei-e
9

security-auditor

Audit codebases for security vulnerabilities and produce structured OWASP-aligned findings reports.

Community
Advanced
BagelHoleBagelHole
46

dast-scanning

Perform DAST scans on web applications and APIs with OWASP ZAP.

Community
Intermediate
LeoWSY-hashblueLeoWSY-hashblue
3

source-code-scanning

Scan source code for vulnerabilities, secrets, and dependency CVEs.

Community
Advanced