security-audit

Identify security weaknesses in codebases through a four-phase audit workflow.

73|29|Updated Oct 19, 2017

Search Tags:#security #audit #reporting #vulnerabilities #threat-modeling #code-review

Ready to run

npx skills add https://github.com/mswell/dotfiles --skill security-audit-mswell

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/mswell/dotfiles/tree/main/setup/Skills/security-audit
Command: npx skills add https://github.com/mswell/dotfiles --skill security-audit-mswell

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Security teams and developers need a structured way to identify, analyze, and document security issues across complex codebases. This Skill provides a repeatable, multi-phase workflow that yields concrete, evidence-backed findings and a comprehensive report.

Core Features & Use Cases

Multi-phase assessment (Assessment → Threat Model → Code Review → Report) with artifacts like SECURITY.md, THREAT_MODEL.json, VULNERABILITIES.json, and scan_report.md.
STRIDE-based threat modeling and code review to validate findings with evidence.
Automation-friendly reporting pipeline that produces actionable remediation guidance for bug bounty, compliance, and hardening tasks.

Quick Start

Run a full security audit on your codebase to generate the threat model and vulnerability report.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a security audit on my codebase to identify vulnerabilities?▼

A security audit identifies vulnerabilities through a four-phase workflow: Assessment, Threat Model, Code Review, and Report. It uncovers authentication, input validation, data-flow, dependency, and configuration issues, producing an actionable report for remediation.

How does STRIDE-based threat modeling work for web apps and microservices?▼

STRIDE-based threat modeling categorizes security threats across diverse stacks like web apps and microservices. It analyzes data-flow and authentication risks to validate findings with evidence, outputting structured artifacts like THREAT_MODEL.json for hardening tasks.

What is the best way to generate a threat model and vulnerability report for an API?▼

The best way to generate a vulnerability report for an API is an automation-friendly workflow that produces SECURITY.md, VULNERABILITIES.json, and scan_report.md. It uses scripted detection and evidence-based validation to deliver actionable remediation guidance.

Can I use this security review workflow for cloud-native services and microservices?▼

Yes, this security review workflow applies across diverse stacks including cloud-native services and microservices. It requires scripted detection and code review to uncover configuration and dependency issues specific to those environments.

What artifacts are produced when running a codebase security review?▼

Running a codebase security review produces concrete, evidence-backed artifacts including SECURITY.md, THREAT_MODEL.json, VULNERABILITIES.json, and scan_report.md. These files document identified weaknesses and provide actionable remediation guidance for compliance.

Why do I need threat modeling and code review for vulnerability reporting?▼

Threat modeling and code review are needed for vulnerability reporting because they validate findings with concrete evidence. This structured approach ensures that authentication and input validation issues are accurately documented for bug bounty and hardening tasks.