skills.rest
levori119
levori119COMMUNITY
Explore all skills by this author →
GitHub

security-audit

Audits application code against OWASP, NIST, and ISO standards and generates a Hebrew HTML security report.

Updated Mar 26, 2026
Search Tags:#code review#owasp#vulnerability assessment#security audit#nist#supply chain#sbom
One-click install
npx skills add https://github.com/levori119/skyboard --skill security-audit-levori119
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/levori119/skyboard/tree/main/.claude/skills/security-audit
Command: npx skills add https://github.com/levori119/skyboard --skill security-audit-levori119

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security reviews of a full-stack application are slow, inconsistent, and hard to map to formal standards. This Skill performs a structured 12-check security audit of the codebase (authentication, SQL injection, XSS, secrets, dependencies, supply chain, deployment) and produces a standards-mapped HTML report with severity ratings and a prioritized remediation plan. ## Core Features & Use Cases - 12-Point Audit Checklist: Systematically checks authentication/authorization, SQL injection, XSS/DOM sinks, hardcoded secrets, security headers, runtime internet dependencies, audit logging, multi-tenancy isolation, supply chain, deployment infrastructure, reliability, and verified-correct findings. - Standards Mapping: Maps every finding to OWASP Top 10:2021, CWE, and at least one of OWASP ASVS, NIST SP 800-53/800-218/800-171, or ISO/IEC 27001:2022. - Dependency & Origin Analysis: Builds tables of direct, dev, and transitive dependencies with maintainer country of origin, install-script detection, and SBOM generation via npm. - Use Case: Before presenting a system to a classified security customer or before a version release, run the audit to get a SECURITY_AUDIT.html document with findings referenced by exact file:line, reproducible curl exploits, and a phased remediation plan with time estimates. ## Quick Start Run a full security audit of this repository and generate the SECURITY_AUDIT.html report with findings mapped to OWASP and NIST.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on a Node.js and React codebase?▼

Run the 12-check audit workflow: map the attack surface, then check authentication, SQL injection, XSS sinks, secrets, headers, runtime internet dependencies, audit logging, tenancy isolation, supply chain, deployment, and reliability. Each finding is graded and written into a SECURITY_AUDIT.html report.

What does the security audit check for in dependencies?▼

It runs npm audit, lists production and transitive dependencies, detects packages with preinstall/install/postinstall scripts, flags abandoned packages, prebuilt native binaries, and misplaced devDependencies, and generates a CycloneDX SBOM with npm sbom.

How are audit findings mapped to security standards?▼

Each finding is mapped to OWASP Top 10:2021 and CWE, plus at least one of OWASP ASVS 4.0.3, NIST SP 800-53 Rev.5, NIST SP 800-218 SSDF, NIST SP 800-171, or ISO/IEC 27001:2022. Uncertain clause numbers are described verbally rather than invented.

Does the audit fix the vulnerabilities it finds?▼

No. The audit only reports findings with exact file:line references, reproducible exploit commands, and a phased remediation plan with time estimates. All fixes are left to the user because security changes touch core system behavior.

Can the audit run as a delta review instead of a full scan?▼

Yes. If a previous SECURITY_AUDIT.html exists, the audit reads it first and compares: fixed findings are closed with a commit reference, unfixed findings stay open, and only changed code is re-examined.

Why does the audit flag runtime CDN and external API calls?▼

For classified or air-gapped deployments, any runtime internet dependency is a finding: code downloaded from CDNs is critical, operational data sent externally is critical, and read-only API calls are medium. The system must work with zero external calls on a disconnected network.

Related Skills

Explore More Software Engineering Skills→
alexica00alexica00

audit-codebase

Audit codebases by scoring seven health categories and generating a prioritized progression plan.

Community
Advanced
LerianStudioLerianStudio
205

ops-security-audit

Automate infrastructure security audits with phased scanning and compliance mapping.

Official
Advanced
pacphipacphi
6

security-testing

Identify and validate security vulnerabilities in software applications.

Community
Advanced
bs-koobs-koo

auditing-web-application-security

Orchestrates static and dynamic security audits of Spring and JSP web applications into unified reports.

Community
Advanced