security-auditor

Identify and mitigate OWASP Top 10 application security risks.

Updated Jul 13, 2023

Search Tags:#authorization #security #authentication #owasp #auditing #risk-assessment #threat-modeling

Ready to run

npx skills add https://github.com/changgenglu/changgenglu-blog --skill security-auditor-changgenglu

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/changgenglu/changgenglu-blog/tree/main/prompt_engineering/gemini/skills/security-auditor
Command: npx skills add https://github.com/changgenglu/changgenglu-blog --skill security-auditor-changgenglu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Activates when user requests security review, penetration test analysis, sensitive data handling, authentication/authorization design, or OWASP risk assessment. Do NOT use for general code style reviews. Examples: 'Check for SQL injection', 'Review authentication flow'.

Core Features & Use Cases

OWASP Top 10 based risk checks including risk identification, threat modeling, and secure design guidance.
Guidance on secure data handling, cryptographic best practices, and secure logging.
Use Case: Provide a security review for an API gateway and web app, outlining findings and recommended mitigations.

Quick Start

Provide a structured security review covering authentication, data handling, logging, and secure design using OWASP Top 10 criteria.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform an OWASP Top 10 security review for my web application?▼

To perform an OWASP Top 10 security review, identify and mitigate common application risks through structured checks on authentication, authorization, data handling, and secure logging. This process applies structured threat modeling and risk assessment to web and API components.

What is the best way to check my API authentication and authorization flow for security risks?▼

Checking API authentication and authorization flows requires hardening designs against common risks using structured OWASP Top 10 criteria. This process identifies vulnerabilities in sensitive data handling and provides recommended mitigations for your API gateway.

Can I use this approach for threat modeling and risk assessment across my development lifecycle?▼

Yes, you can use this structured risk assessment approach for threat modeling across development lifecycles. It applies OWASP Top 10 checks to web and API components, identifying security risks and providing secure design guidance during reviews.

How does structured OWASP risk assessment handle sensitive data and secure logging practices?▼

Structured OWASP risk assessment evaluates sensitive data handling by applying cryptographic best practices and secure logging guidelines. It identifies potential exposure risks during security reviews and recommends mitigations to ensure data protection.

When should I not use an OWASP Top 10 security review for my codebase?▼

You should not use an OWASP Top 10 security review for general code style reviews. This approach specifically targets penetration test analysis, sensitive data handling, authentication design, and risk assessment rather than formatting or stylistic code improvements.