common-security-audit
Automated security scanning tool for detecting secrets, injection vulnerabilities, and dependency CVEs.
Install
mkdir -p .claude/skills/common-security-audit && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/16605" && unzip -o skill.zip -d .claude/skills/common-security-audit && rm skill.zipInstalls to .claude/skills/common-security-audit
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue), and mobile (iOS, Android, Flutter) codebases. Use when performing security audits, vulnerability scans, secrets detection, or penetration testing.Key capabilities
- →Scan for hardcoded secrets in backend, frontend, and mobile code
- →Detect data leakage in logs across various languages
- →Map injection surfaces and measure authentication coverage
- →Run dependency CVE scans for Node, Python, Rust, Go, Dart, Java, and mobile platforms
- →Perform frontend-specific audits for exposed secrets and DOM sinks
- →Conduct mobile-specific audits for insecure storage and cert pinning
How it works
This skill probes codebases for security vulnerabilities by scanning for hardcoded secrets, detecting data leakage in logs, mapping injection surfaces, running dependency CVE scans, and performing platform-specific audits. It identifies weaknesses across backend, frontend, and mobile applications.
Inputs & outputs
When to use common-security-audit
- →Scan for exposed API keys and environment secrets
- →Identify injection vulnerabilities and auth gaps
- →Run dependency CVE checks
- →Audit logs for sensitive data exposure
About this skill
Security Audit
Priority: P0 (CRITICAL)
1. Scan for Hardcoded Secrets
See implementation examples for secrets scanning commands.
Covers: Backend source, frontend bundles (REACT_APP_, NEXT_PUBLIC_, VITE_), mobile configs (BuildConfig, iOS configurations, strings.xml).
2. Detect Data Leakage in Logs
See implementation examples for log leakage scanning commands across Node, Go, Dart, Java, Swift.
3. Map Injection Surfaces & Auth Coverage
See implementation examples for injection detection and auth coverage measurement.
4. Run Dependency CVE Scans
- Node/Python/Rust:
npm audit --audit-level=high|pip-audit|cargo audit - Go/Dart:
go list -m -u all|dart pub outdated --json - Java/Mobile:
mvn dependency:list/./gradlew dependencies|pod audit/ Gradle scan
5. Infrastructure & Adversarial Entry Points
See implementation examples for RCE/SSRF/Path Traversal and infrastructure hardening (Docker/K8s).
6. Frontend-Specific Audit
- Exposed Secrets:
grep -rE "(REACT_APP_|NEXT_PUBLIC_|VITE_)" . --include="*.ts*" --include="*.env*" - DOM Sinks & Source Maps: Check
dangerouslySetInnerHTML,innerHTML,eval, and.mapfiles in prod builds.
7. Mobile-Specific Audit
See mobile audit commands for insecure storage (credential stores/Keystore), cert pinning, debug flags, and deep links.
8. Business Logic & Advanced Attacks
- BOLA/IDOR: Verify entity lookups always enforce tenant/owner ownership checks (e.g. any
findByIdwithout anownerfilter is a P0 IDOR vulnerability). - JWT / Mass Assignment: Check missing
exp, weak keys, and uncontrolled property spread (...req.body). - Race / GraphQL: Verify atomic DB transactions, introspection disabled, and query depth limits.
Scoring Impact
| Finding | Threshold | Severity | Deduction |
|---|---|---|---|
| Hardcoded Secrets | Any match | P0 | -25 |
| Plain-text PII in Logs | Any match | P0 | -20 |
| Unguarded Routes > 20% | > 0.2 | P0 | -15 |
| Raw SQL Concatenation | Any match | P1 | -10 |
| Response Leakage (Stack) | > 0 | P1 | -10 |
| Insecure Mobile Storage | Token in plaintext | P1 | -15 |
| Missing Cert Pinning | No pinning detected | P2 | -8 |
| DOM XSS Sinks | Any match | P1 | -10 |
CAUTION: P0 finding immediately caps Security score at 40/100. Immediate actions for leaked secrets: rotate the credential NOW and purge from history.
Anti-Patterns
- No applying generic patterns over project-specific rules: Respect existing security constraints.
- No ignoring error handling or edge cases: Audit must cover boundary conditions.
- No backend-only audit: Always check frontend AND mobile when in-scope.
References
Canonical response anchors
When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:
- -25
When not to use it
- →When applying generic security patterns over project-specific rules
- →When ignoring error handling or edge cases during an audit
- →When performing a backend-only audit for a project with frontend and mobile components
Limitations
- →The skill's scoring impact defines specific thresholds for severity deductions
- →A P0 finding immediately caps the Security score at 40/100
- →The skill requires specific implementation examples for scanning commands
How it compares
This skill provides a complete, multi-faceted security audit workflow that covers various vulnerability types and platforms, offering a structured approach to identifying security flaws beyond simple static analysis.
Compared to similar skills
common-security-audit side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| common-security-audit (this skill) | 0 | 1mo | Review | Advanced |
| dependency-auditor | 1 | 9mo | Review | Beginner |
| constant-time-analysis | 1 | 2mo | Review | Advanced |
| cyber-audit | 0 | 2mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by HoangNguyen0403
View all by HoangNguyen0403 →You might also like
dependency-auditor
alirezarezvani
Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.
constant-time-analysis
trailofbits
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
cyber-audit
Matymatyk-business
Read-only exposure audit of the user's machine and projects for a CVE, breach, malicious package, or other security advisory, then write a structured report to a local audit folder. Use when the user shares a breach/CVE/malware/supply-chain advisory and asks if they're affected, says "scan my system
security-header-generator
Dexploarer
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS setup".
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
security-best-practices
openai
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.