audit-security

Scan codebases for OWASP Top 10 and input validation vulnerabilities.

1|Updated Feb 28, 2026
One-click install
npx skills add https://github.com/im9/inboil --skill audit-security-im9
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-security
Source: https://github.com/im9/inboil/tree/main/.claude/skills/audit-security
Command: npx skills add https://github.com/im9/inboil --skill audit-security-im9

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Scan the codebase for security vulnerabilities. Check OWASP Top 10, input validation weaknesses, authentication & authorization gaps, cryptographic risks, and track known issues documented in docs/ai/BACKLOG.md.

Core Features & Use Cases

  • Automated vulnerability discovery using OWASP Top 10 checks across project files.
  • Input validation checks to block prototype pollution, XSS, and injection risks.
  • Authentication & authorization review to flag weak access controls and token handling.
  • Backlog alignment with docs/ai/BACKLOG.md to ensure known issues are tracked and remediated.
  • Use Case: Integrate into CI to automatically surface issues during code review and release.

Quick Start

Run the security audit workflow against the repository to generate a vulnerability report.

Frequently Asked Questions about audit-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my codebase for OWASP Top 10 vulnerabilities?

You can audit your codebase for OWASP Top 10 vulnerabilities by running an automated security scan that analyzes project files for injection risks, weak authentication, and cryptographic flaws. The scan reads your source code to generate a vulnerability report.

What is the best way to check for input validation weaknesses and XSS risks in my code?

The best way to check for input validation weaknesses is to run a security audit that scans project files for prototype pollution, XSS, and injection risks. This process surfaces validation gaps and reports them for remediation.

Can I integrate security vulnerability scanning into my CI pipelines?

Yes, you can integrate security vulnerability scanning into CI pipelines to automatically surface issues during code review and release. The audit checks authentication gaps and crypto risks across project files in the pipeline workflow.

How does the security audit align with known issues in my project backlog?

The security audit aligns with your project backlog by reading docs/ai/BACKLOG.md to surface known security issues. It validates coverage against security tests to ensure documented vulnerabilities are tracked and remediated.

Do I need to configure authentication or token handling checks before running a codebase security audit?

No, you do not need to configure authentication checks beforehand. The security audit automatically reviews authentication and authorization logic across the codebase to flag weak access controls and improper token handling.