skills.rest
JHostalek
JHostalekCOMMUNITY
Explore all skills by this author →
GitHub

audit-security

Audit and fix software security weaknesses across code, configuration, and infrastructure.

10|5|Updated Mar 3, 2026
Search Tags:#authorization#authentication#owasp#secure coding#threat modeling#security audit#vulnerability review
One-click install
npx skills add https://github.com/JHostalek/dotclaude --skill audit-security-jhostalek
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-security
Source: https://github.com/JHostalek/dotclaude/tree/main/skills/audit-security
Command: npx skills add https://github.com/JHostalek/dotclaude --skill audit-security-jhostalek

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps identify and remediate security weaknesses that could compromise confidentiality, integrity, availability, privacy, tenant isolation, or privileged actions. It replaces checklist-driven reviews with architecture-aware threat analysis and evidence-based fixes.

Core Features & Use Cases

  • Architecture-Led Auditing: Reconstruct assets, actors, trust boundaries, data flows, entry points, privileges, dependencies, and deployment assumptions before testing.
  • Comprehensive Security Coverage: Examine authentication, authorization, injection, APIs, business logic, data protection, supply chain, infrastructure, runtime resilience, client surfaces, AI systems, and configuration.
  • Evidence-Based Remediation: Trace attacker-controlled inputs to sensitive sinks, rank findings by realistic impact, propose safe fixes, verify regressions, and document reviewed, inapplicable, or deferred areas.
  • Use Case: Apply it to a web application before release to uncover cross-tenant access flaws, SSRF, exposed secrets, weak session handling, vulnerable dependencies, and unsafe deployment settings.

Quick Start

Use the audit-security skill to perform a comprehensive security review of the specified path, fix safe findings, and provide a coverage ledger with residual risks.

Frequently Asked Questions about audit-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform an architecture-led security audit on web applications before release?▼

An architecture-led security audit reconstructs assets, actors, trust boundaries, and data flows before testing to uncover cross-tenant access flaws, SSRF, and exposed secrets in web applications. It replaces checklist reviews with threat modeling and evidence-based fixes.

What is threat modeling and trust-boundary analysis for secure coding?▼

Threat modeling and trust-boundary analysis map out actors, entry points, privileges, and deployment assumptions to trace attacker-controlled inputs to sensitive sinks. This approach identifies realistic vulnerabilities across code, configuration, and infrastructure boundaries.

Can I use automated vulnerability review for cloud deployments and distributed systems?▼

Vulnerability review applies to cloud deployments and distributed systems by examining authentication, authorization, APIs, data protection, and infrastructure. It evaluates runtime resilience and deployment settings to ensure tenant isolation and privileged action security.

How do I fix insecure authentication and authorization configurations in CI/CD pipelines?▼

Fix insecure authentication and authorization by proposing safe remediations, verifying regressions, and documenting reviewed areas. You trace attacker-controlled inputs to sensitive sinks, rank findings by realistic impact, and apply defensive validation across CI/CD pipelines.

Does security auditing work for AI and agentic systems with complex data flows?▼

Security auditing works for AI and agentic systems by analyzing complex data flows, operational boundaries, and runtime resilience. It ensures complete coverage accounting and defensive validation across client surfaces and privileged actions.

What are the limitations of checklist-driven security reviews compared to evidence-based remediation?▼

Checklist-driven reviews lack architecture awareness and often miss cross-tenant access flaws or SSRF. Evidence-based remediation traces attacker inputs to sensitive sinks, ranks findings by impact, verifies regressions, and documents deferred areas for complete coverage.

Related Skills

Explore More Software Engineering Skills→
utkusenutkusen
1.3k

sast-analysis

Map codebase architecture and technology stack into sast/architecture.md.

Community
Intermediate
rocklambrosrocklambros
2

writing-release-notes-as-postmortem

Write postmortem-style release notes with severity-sorted fix entries.

Community
Advanced
marcosd4hmarcosd4h
17

taint-analysis

Trace attacker-controlled inputs to sinks and origins across module boundaries.

Community
Advanced
zangxin75zangxin75

security

Assess vulnerabilities and review code against OWASP Top 10 standards.

Community
Advanced