security-auditor

Audit codebases against the OWASP Top 10 (2021) and generate prioritized findings reports.

3|2|Updated Jun 9, 2026

Search Tags:#security #vulnerability #owasp #reporting #risk-assessment #pentest #code-audit

Ready to run

npx skills add https://github.com/JayRHa/AgentSkills --skill security-auditor-jayrha

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/JayRHa/AgentSkills/tree/main/security-auditor
Command: npx skills add https://github.com/JayRHa/AgentSkills --skill security-auditor-jayrha

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audits codebases against the OWASP Top 10 (2021) to identify concrete, exploitable security findings and provide prioritized fixes with a reproducible findings report.

Core Features & Use Cases

Guide scoping of security reviews: languages, entry points, trust boundaries, and data flow.
Triage and discovery with scripts (grep_audit.sh) to surface high-signal vulnerability patterns.
Produce a prioritized findings report using templates/finding-report.md including concrete PoC, severity, and copy-pasteable fixes.
Deliver a structured, auditable report suitable for security reviews, remediation planning, and compliance artifacts.

Quick Start

Run the security-auditor against a codebase to generate a findings report following the OWASP-top-10 workflow.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit my codebase for OWASP Top 10 vulnerabilities?▼

Auditing a codebase for OWASP Top 10 vulnerabilities involves triaging with grep patterns, tracing tainted data from source to sink, confirming exploits with PoCs, rating severity, and delivering a templated findings report.

What is the best way to generate a security findings report with remediation steps?▼

Generating a security findings report with remediation steps requires tracing tainted data flows to confirm exploitable weaknesses, then outputting a prioritized, template-based report containing proof of concepts, severity ratings, and copy-pasteable fixes.

How do I identify trust boundaries and entry points for a code security review?▼

Identifying trust boundaries and entry points for a code security review involves scoping the application's languages and data flow to map where untrusted input enters, which is essential for accurate vulnerability discovery and risk assessment.

Can I use automated grep patterns to discover exploitable security weaknesses?▼

Using automated grep patterns to discover exploitable security weaknesses is possible through triage scripts that surface high-signal vulnerability patterns, which must then be manually traced from source to sink to confirm exploitability.

Does this security audit approach work without external dependencies or components?▼

This security audit approach works without external dependencies or components, relying entirely on internal scripts and templates to guide the OWASP Top 10 review workflow from initial triage to final reporting.