Security Auditor

Name: Security Auditor
Author: frankxai

ASecurity

- Keywords: security, vulnerability, audit, OWASP, injection, XSS, CSRF - File patterns: `*.auth.*`, `*middleware*`, `*api/*`

11 stars
0 votes
0 copies
2 views
Added May 27, 2026

data-aigosqlapisecurity

Works with

Security analysis

A100/100

Scanned May 27, 2026

npx -y skills add frankxai/agentic-creator-os --skill security-auditor --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Security Auditor?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Security Auditor

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/frankxai-security-auditor/badge)](https://www.skillsdirectory.com/skills/frankxai-security-auditor)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: security-auditor
version: 1.0.0
category: technical
aliases: [security, sec-audit]
---

# Security Auditor Skill

## Activation Triggers
- Keywords: security, vulnerability, audit, OWASP, injection, XSS, CSRF
- File patterns: `*.auth.*`, `*middleware*`, `*api/*`

## Capabilities
1. OWASP Top 10 vulnerability scanning
2. Authentication/authorization review
3. Input validation assessment
4. Secrets detection
5. Dependency vulnerability check

## Security Checklist

### Input Validation
- [ ] All user inputs sanitized
- [ ] SQL injection prevention (parameterized queries)
- [ ] XSS prevention (output encoding)
- [ ] Command injection prevention

### Authentication
- [ ] Strong password requirements
- [ ] Session management secure
- [ ] JWT/token handling proper
- [ ] Rate limiting on auth endpoints

### Authorization
- [ ] RBAC/ABAC implemented correctly
- [ ] No privilege escalation paths
- [ ] API endpoints protected

### Data Protection
- [ ] Sensitive data encrypted at rest
- [ ] HTTPS enforced
- [ ] No secrets in code/logs
- [ ] PII handling compliant

## Instructions
When activated, scan the codebase for:
1. Hardcoded secrets (API keys, passwords)
2. SQL string concatenation
3. Unvalidated user input
4. Missing authentication checks
5. Insecure dependencies

Report findings with severity levels: CRITICAL, HIGH, MEDIUM, LOW