security-audit

Assess application codebases for authentication, authorization, and secret handling flaws.

453|34|Updated Feb 9, 2026

Search Tags:#code-review #security-audit #vulnerability-assessment #owasp-top-10 #compliance-check #secret-handling #cvss-scoring

Ready to run

npx skills add https://github.com/josstei/maestro-orchestrate --skill security-audit-josstei

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/josstei/maestro-orchestrate/tree/main/plugins/maestro/skills/security-audit
Command: npx skills add https://github.com/josstei/maestro-orchestrate --skill security-audit-josstei

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually scanning code for security flaws across authentication, secret handling, and OWASP Top 10 risks is time-consuming and prone to missing critical exploitable vulnerabilities, especially in complex codebases with multiple trust boundaries.

Core Features & Use Cases

Full-scope security assessment: Covers authentication, authorization, data exposure, secret handling, and high-risk dependency checks aligned with CVSS severity scoring.
Exploitability analysis: Traces trust boundaries and auth flows to identify flaws that pose real-world attack risks, not just theoretical issues.
Use case: Use this for pre-deployment code reviews, compliance audits, or security incident debugging to get prioritized remediation guidance for the highest-risk issues first.

Quick Start

Use the security-audit skill to run a full security assessment of the user authentication module in the attached project and get a prioritized list of critical vulnerabilities with remediation steps.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a security audit for code vulnerabilities before deployment?▼

Run a security audit to perform end-to-end security assessments across authentication, authorization, data exposure, and secret handling. It identifies OWASP Top 10 vulnerabilities and delivers CVSS-aligned severity classifications with prioritized remediation guidance for pre-deployment code reviews.

What is the best way to check my codebase for OWASP Top 10 vulnerabilities and unsafe defaults?▼

Checking for OWASP Top 10 vulnerabilities requires tracing trust boundaries and authentication flows to identify real-world exploitable flaws. A security audit delivers exploitability assessments and prioritized remediation guidance for unsafe default configurations across your codebase.

Can I use an automated security audit for compliance checks and high-risk dependency analysis?▼

An automated security audit supports compliance checks and high-risk dependency analysis by performing full-scope security assessments. It evaluates secret handling and data exposure flaws, providing CVSS severity scoring to ensure compliance across all supported runtime targets.

How does CVSS scoring work when assessing codebase security flaws?▼

CVSS scoring during a security audit aligns identified vulnerabilities with standardized severity classifications. It traces trust boundaries and authentication flows to assess exploitability, ensuring you receive prioritized remediation guidance for the highest-risk issues first.

Why does my code review miss critical exploitable vulnerabilities in complex codebases?▼

Manual code reviews miss critical exploitable vulnerabilities in complex codebases due to multiple trust boundaries and time-consuming manual scanning. An automated security audit applies exploitability analysis to trace authentication flows and identify real-world attack risks efficiently.

Does a security audit work for debugging security incidents in existing application code?▼

A security audit works for security incident debugging by performing end-to-end security assessments on existing application code. It identifies authentication, authorization, and secret handling flaws, delivering CVSS-aligned severity classifications to guide incident resolution.