security-audit

Audit TypeScript web apps for security issues with file:line evidence.

Updated Aug 27, 2026
One-click install
npx skills add https://github.com/maxbeaudoin/productflash --skill security-audit-maxbeaudoin
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/maxbeaudoin/productflash/tree/main/.claude/skills/security-audit
Command: npx skills add https://github.com/maxbeaudoin/productflash --skill security-audit-maxbeaudoin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you systematically uncover security weaknesses in a web or SaaS codebase and translate them into prioritized, evidence-backed findings you can act on.

Core Features & Use Cases

  • Comprehensive, read-only audit workflow: Guides a phased review across auth/session, authorization & tenant isolation, input injection vectors, common OWASP risks, secrets handling, LLM-specific abuse, and dependencies.
  • Evidence-first reporting: Requires concrete findings with file:line references and short code excerpts rather than speculative guidance.
  • Ranked remediation output: Produces one consolidated report with severity, likelihood, impact, attacker scenario framing, and specific remediation recommendations.

Quick Start

Ask for a security audit of your repository and request a single ranked report with evidence in file:line format, using the skill's read-only methodology.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on a TypeScript web app to find real vulnerabilities?

Run a security audit by requesting a read-only review of your TypeScript web app, which produces a comprehensive report with concrete file-and-line evidence for issues like injection vectors and weak authorization.

What is the best way to check tenant isolation and authorization logic for security flaws?

The best way to check tenant isolation is using an evidence-first security audit that reviews your authorization logic and outputs ranked findings with severity, impact, and specific remediation recommendations.

Can I detect LLM prompt injection and dependency supply chain risks during a code review?

Yes, you can detect LLM prompt injection and dependency supply chain risks by applying a phased audit workflow that scans for LLM-specific abuse surfaces and vulnerable dependencies in your codebase.

Does a security audit report provide exact file and line references for identified issues?

A security audit report does provide exact file and line references, requiring concrete code excerpts and evidence-first findings rather than speculative guidance to ensure actionable remediation.

How are security findings prioritized when reviewing code for XSS, CSRF, and SSRF vulnerabilities?

Security findings for XSS, CSRF, and SSRF vulnerabilities are prioritized using a ranked output that includes severity, likelihood, impact, and attacker scenario framing to guide your remediation efforts.

When should I expect verification needed notes in my web application security audit report?

You should expect verification needed notes in your security audit report when runtime proof is unavailable, ensuring that findings requiring dynamic testing are clearly flagged for further validation.