skills.rest
yi-john-huang
yi-john-huangCOMMUNITY
Explore all skills by this author →
GitHub

sdd-security-check

Automate OWASP-aligned security audits across code repositories, APIs, and deployment pipelines.

48|4|Updated Sep 8, 2025
Search Tags:#security#codebase#owasp#audit#reporting#vulnerabilities
One-click install
npx skills add https://github.com/yi-john-huang/sdd-mcp --skill sdd-security-check
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sdd-security-check
Source: https://github.com/yi-john-huang/sdd-mcp/tree/main/.claude/skills/sdd-security-check
Command: npx skills add https://github.com/yi-john-huang/sdd-mcp --skill sdd-security-check

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Perform comprehensive security audits aligned with OWASP Top 10 and security best practices. Identify vulnerabilities before they reach production.

Core Features & Use Cases

  • A01: Broken Access Control checks to verify authorization on endpoints and prevent insecure Direct Object References (IDOR) and missing function-level access control.
  • A02: Cryptographic Failures checks for weak algorithms, hardcoded secrets, and insufficient encryption at rest.
  • A03: Injection checks to prevent SQL/NoSQL/command/template injection through input handling and parameterization.
  • A04: Insecure Design checks for missing rate limiting, brute force protection, predictable resource IDs, and threat modeling gaps.
  • A05: Security Misconfiguration checks for debug mode in production, default credentials, security headers, verbose error messages, and related misconfigurations.
  • A06: Vulnerable Components checks via dependency review and CVE awareness (npm audit guided).
  • A07: Authentication Failures checks for session security practices and password hygiene.
  • A08: Software and Data Integrity Failures checks for unsigned artifacts and insecure CI/CD practices.
  • A09: Security Logging and Monitoring Failures checks to ensure secure logging practices and auditable trails.
  • A10: Server-Side Request Forgery checks to validate outbound URLs and prevent misuse.

Quick Start

Run the security check against your codebase to produce a comprehensive security audit report.

Frequently Asked Questions about sdd-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate an OWASP Top 10 security audit for my codebase?▼

Automate an OWASP Top 10 security audit by running static and dynamic analysis checks across your codebase to identify vulnerabilities, assess risks, and generate detailed remediation reports. It scans code repositories, APIs, and deployment pipelines.

Can I detect hardcoded secrets and cryptographic failures in my code repositories?▼

Detect cryptographic failures and hardcoded secrets in code repositories using automated checks for weak algorithms, insufficient encryption, and gitleaks secret detection to prevent sensitive data exposure before deployment.

What's the best way to check for injection vulnerabilities and broken access control in APIs?▼

Check for injection vulnerabilities and broken access control in APIs by verifying endpoint authorization, preventing insecure direct object references, and validating input handling to stop SQL, NoSQL, command, and template injection attacks.

Does this security audit support dependency review and CVE awareness for vulnerable components?▼

The security audit supports dependency review and CVE awareness for vulnerable components by running npm audit guided scans to detect outdated libraries and enforce security misconfiguration checks across your deployment pipelines.

How do I prevent Server-Side Request Forgery and insecure CI/CD practices in my deployment pipelines?▼

Prevent Server-Side Request Forgery and insecure CI/CD practices by validating outbound URLs, checking for unsigned artifacts, and enforcing configuration checks across your deployment pipelines to ensure software and data integrity.

Why do I need to check my codebase for security logging failures and authentication weaknesses?▼

Check your codebase for security logging failures and authentication weaknesses to ensure secure logging practices, maintain auditable trails, enforce session security, and verify password hygiene to prevent unauthorized access.

Related Skills

Explore More Software Engineering Skills→
FrekiManagarmFrekiManagarm

source-command-sparc-security-review

Perform static and dynamic code audits to flag security vulnerabilities.

Community
Advanced
vladkeslervladkesler
39

javascript-sast

Scan JavaScript and Node.js projects for security vulnerabilities via npm audit and source patterns.

Community
Intermediate
jakezpjakezp
17

security-review

Enforce security best practices across codebases and CI/CD pipelines.

Community
Advanced
PaulKinlanPaulKinlan
2

vulnerability-scan

Scan source code for security vulnerabilities using OWASP methodology and CLI tools.

Community
Advanced