security-audit

What problem does it solve?

This Skill automates comprehensive security audits, eliminating the need for manual, time-consuming, and specialized checks. It ensures your application adheres to robust security standards, protecting sensitive data and preventing vulnerabilities.

Core Features & Use Cases

• Automated Security Checks: Validates encryption key security, GDPR compliance, and input validation across the application.
• OWASP Best Practices: Verifies authentication mechanisms (scrypt hashing, session management) and secure coding patterns.
• Encrypted Field Validation: Confirms AES-256-GCM encryption on 11 sensitive database fields.
• Use Case: Before a production release, Claude automatically audits the application's security posture, checking for uncommitted .env files, GDPR compliance, and proper password hashing, providing a clear risk score and actionable recommendations.

Quick Start

Claude automatically runs this skill when:

user: "Is our app secure enough for production?"

Claude checks:

1. Greps for "ENCRYPTION_KEY" in git history to ensure no secrets are exposed.

2. Reads KeyManager tests for coverage of encryption key handling.

3. Validates GDPR rate limits and consent logic in GdprService.ts.

4. Checks Zod schemas in all repositories for robust input validation.

5. Stores the audit results in memory for future reference and trend analysis.