security-audit

Audit application security with patterns for authentication, authorization, IDOR prevention, and webhook verification.

Updated Jan 31, 2026
One-click install
npx skills add https://github.com/nhson2612/__ --skill security-audit-nhson2612
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/nhson2612/__/tree/main/.claude/skills/security
Command: npx skills add https://github.com/nhson2612/__ --skill security-audit-nhson2612

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses critical security vulnerabilities in applications, ensuring robust protection against common threats like IDOR, unauthorized data access, and insecure webhook handling.

Core Features & Use Cases

  • Vulnerability Auditing: Identifies and provides patterns to mitigate risks such as Insecure Direct Object References (IDOR), PII exposure, and missing authentication.
  • Secure Coding Practices: Offers guidance on authentication, authorization, input validation, and webhook verification.
  • Use Case: When developing a new API endpoint, use this Skill to review the authentication and authorization logic, ensuring that users can only access their own data and that sensitive information is properly protected.

Quick Start

Use the security audit skill to review the authentication patterns for the /api/admin endpoints.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent IDOR vulnerabilities in my API endpoints?

To prevent IDOR vulnerabilities, this audit provides explicit checklists for endpoint security and input validation. It enforces secure coding patterns that ensure users can only access their own data, mitigating insecure direct object references.

What is the best way to audit PII exposure in web applications?

Auditing PII exposure involves applying explicit data handling guidance to prevent unauthenticated access to sensitive information. This skill provides patterns to review data protection mechanisms and secure Personally Identifiable Information.

How do I verify webhook security for incoming API requests?

Verifying webhook security requires validating incoming payloads using explicit guidance on endpoint security. This skill provides patterns for webhook verification to ensure your application safely handles external event notifications.

How do I review authentication and authorization logic before deploying an API?

Reviewing authentication and authorization logic involves using checklists to validate endpoint access controls and data handling rules. This skill offers explicit secure coding guidance to ensure robust protection against unauthorized data access.

Does this security audit work for applications with no external dependencies?

Yes, this security audit operates with no external dependencies. It provides self-contained patterns and checklists for vulnerability auditing, input validation, and secure coding practices directly within your software engineering workflow.