skills.rest
7a336e6e
7a336e6eCOMMUNITY
Explore all skills by this author →
GitHub

conducting-security-audit

Audit code, infrastructure, and logic flows for security vulnerabilities.

1|2|Updated Feb 5, 2026
Search Tags:#OWASP#security#vulnerability#audit#DAST#SAST
One-click install
npx skills add https://github.com/7a336e6e/skills --skill conducting-security-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-security-audit
Source: https://github.com/7a336e6e/skills/tree/main/security/conducting-security-audit
Command: npx skills add https://github.com/7a336e6e/skills --skill conducting-security-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ../auditing-dependencies/SKILL.md, ../../backend/handling-errors/SKILL.md, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill proactively identifies and helps remediate security vulnerabilities within your codebase, infrastructure, and application logic, preventing potential exploits and data breaches.

Core Features & Use Cases

  • Automated Scanning: Leverages SAST tools to detect common vulnerability patterns and secrets.
  • Manual Code Review: Focuses on critical logic flows (auth, payments) to uncover business logic flaws and access control issues.
  • Simulated Attacks: Employs DAST principles to test for common web vulnerabilities like XSS and CSRF.
  • Use Case: Before deploying a new e-commerce feature, run this audit to ensure no payment data is exposed and that user sessions are secure.

Quick Start

Conduct a comprehensive security audit of the current project, focusing on authentication and payment processing vulnerabilities.

Frequently Asked Questions about conducting-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit for OWASP Top 10 vulnerabilities in my codebase?▼

A security audit combines static analysis, manual review of critical paths, and dynamic analysis simulation to identify OWASP Top 10 vulnerabilities. It scans for secrets and injection flaws, checks business logic, and tests for XSS and CSRF issues.

What is the best way to find IDOR and business logic vulnerabilities in authentication flows?▼

The best way to find IDOR and business logic errors is through manual code review of critical logic flows. This security audit targets authentication and payment paths to uncover access control issues that automated scanning often misses.

Can I use SAST and DAST principles to detect secrets and XSS before deploying an e-commerce feature?▼

Yes, you can use SAST to detect vulnerability patterns and exposed secrets, while applying DAST principles to simulate attacks for XSS and CSRF. This combination ensures payment data and user sessions are secure before deployment.

How does a full-spectrum security audit report vulnerabilities and remediation steps?▼

A full-spectrum security audit outputs a detailed SECURITY_AUDIT.md report. It documents each vulnerability with severity levels, proof of concept, and specific remediation steps, adhering strictly to OWASP Top 10 standards.

Does this security audit work for checking payment processing and user session security?▼

Yes, the security audit specifically targets critical logic flows like payment processing and authentication. It reviews these paths for exposed payment data, access control flaws, and session vulnerabilities to prevent potential exploits.

Related Skills

Explore More Software Engineering Skills→
PaulKinlanPaulKinlan
2

dependency_audit

Audit npm and pip dependencies for vulnerabilities and license compliance.

Community
Intermediate
bostonaholicbostonaholic
8

reviewing-security

Audit code changes for OWASP Top 10 vulnerabilities and severity.

Community
Intermediate
YukiIto1999YukiIto1999

source-code-scanning

Scan source code with Semgrep, CodeQL, and Bandit to detect vulnerabilities and secrets.

Community
Advanced
hypnguyen1209hypnguyen1209
338

web-pentest

Identify and exploit OWASP Top 10 web application vulnerabilities in a structured penetration testing workflow.

Community
Advanced