security-audit

Audit Java code against OWASP Top 10 security risks.

23|7|Updated Feb 22, 2026
One-click install
npx skills add https://github.com/hzy970907/fish-claude-code --skill security-audit-hzy970907
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/hzy970907/fish-claude-code/tree/main/skills/security-audit
Command: npx skills add https://github.com/hzy970907/fish-claude-code --skill security-audit-hzy970907

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps identify and mitigate security vulnerabilities in Java code, ensuring compliance with best practices and protecting against common threats like injection and XSS.

Core Features & Use Cases

  • OWASP Top 10 Coverage: Provides guidance and checks for the most critical web application security risks.
  • Input Validation: Enforces secure input handling using Bean Validation and custom rules.
  • Injection Prevention: Demonstrates secure practices for SQL and other injection types.
  • XSS Prevention: Offers strategies for output encoding and Content Security Policy.
  • Authentication & Authorization: Guides on secure password storage and access control.
  • Secrets Management: Advises on handling sensitive information securely.
  • Dependency Scanning: Integrates with tools like OWASP Dependency-Check.
  • Use Case: Before releasing a new feature, run this Skill to perform a comprehensive security review, identifying potential weaknesses in authentication, input handling, and dependency management.

Quick Start

Use the security-audit skill to review the provided Java code for OWASP Top 10 vulnerabilities.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a Java security audit for OWASP Top 10 vulnerabilities?

To perform a Java security audit, use this Skill to review code against the OWASP Top 10 checklist, covering input validation, injection prevention, XSS mitigation, and secure authentication across frameworks like Spring and Quarkus.

What is the best way to prevent SQL injection in Java Spring applications?

The best way to prevent SQL injection in Java Spring applications is to apply secure coding practices like parameterized queries, which this Skill guides you through using specific code examples and configuration snippets.

How do I secure authentication and manage secrets in Jakarta EE?

To secure authentication and manage secrets in Jakarta EE, this Skill provides guidance on secure password storage, access control, and handling sensitive information securely to prevent unauthorized access.

Can I use OWASP Dependency-Check to scan Java dependencies for vulnerabilities?

Yes, you can use OWASP Dependency-Check to scan Java dependencies, as this Skill integrates dependency scanning to identify and mitigate known vulnerabilities in your project's libraries.

How do I enforce input validation and XSS mitigation in Java web applications?

To enforce input validation and XSS mitigation in Java web applications, this Skill demonstrates secure input handling using Bean Validation and offers strategies for output encoding and Content Security Policy.

Does this security audit checklist work with Quarkus and Spring frameworks?

Yes, this security audit checklist works with Quarkus and Spring frameworks, providing tailored secure coding practices and configuration snippets to address vulnerabilities across various Java environments.