Security Audit (Strike First)
Automated security checklist for identifying code vulnerabilities.
Install
mkdir -p .claude/skills/security-audit-strike-first && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/15730" && unzip -o skill.zip -d .claude/skills/security-audit-strike-first && rm skill.zipInstalls to .claude/skills/security-audit-strike-first
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Expert security analysis focusing on OHM's Sovereign Architecture, Backend vulnerabilities, and Frontend leaks.Key capabilities
- →Scan for exposed secrets like API keys or private keys
- →Check for admin bypass vulnerabilities
- →Verify authentication guards on public endpoints
- →Ensure proper role-based access control for sensitive routes
- →Validate user identity sourcing from JWT
- →Detect sensitive environment variable leakage in frontend bundles
How it works
The skill acts as a Red Team Security Researcher to audit target code by performing critical checks for exposed secrets, admin bypasses, and authentication/authorization issues. It also scans for sensitive data leakage in frontend bundles.
Inputs & outputs
When to use Security Audit (Strike First)
- →Audit code for exposed secrets
- →Verify controller guard implementation
- →Check for frontend environment variable leaks
About this skill
🛡️ Security Audit Skill (Strike First Protocol)
When invoked, act as a Red Team Security Researcher to audit the target code.
1. 🚨 Critical Checks (Zero Tolerance)
- Exposed Secrets: Scan for
API_KEY,SECRET,PRIVATE_KEYin code commits or logs. - Admin Bypass: Ensure no "magic headers" or hardcoded User ID 1 overrides exist (except designated rescue scripts).
- Public Endpoints: Verify every
@Controllerendpoint has@UseGuards(JwtAuthGuard)unless explicitly marked public.
2. 🔐 Authentication & AuthZ
- Check that
RolesGuardis applied to sensitive Admin/Genesis routes. - Verify
current_useris used fromrequest.user(JWT) and not from body data (Spoofing risk). - Ensure
WalletServiceoperations check for ownership or Admin role.
3. 🕸️ Frontend Leakage
- Ensure no sensitive ENV vars (starting with
VITE_or hardcoded) are leaked to the client bundle. - Verify
localStorageis not used for highly sensitive keys (prefer secure cookies or non-persisted state where possible, though OHM uses some localStorage for UX).
4. 📝 Report Format
Output findings in the Strike First Report:
🛡️ Security Analysis Report
| Severity | Location | Vulnerability | Remediation |
|---|---|---|---|
| 🔴 CRITICAL | src/auth/... | Hardcoded Secret | Use .env |
When not to use it
- →When the target is not OHM's Sovereign Architecture
- →When the audit scope is limited to infrastructure security
- →When the focus is on physical security vulnerabilities
Limitations
- →Focuses specifically on OHM's Sovereign Architecture, Backend vulnerabilities, and Frontend leaks
- →Requires access to the target code for analysis
- →The report format is predefined as the 'Strike First Report'
How it compares
This skill provides a structured, Red Team-focused audit process with specific checks for OHM's architecture, unlike a generic static analysis tool.
Compared to similar skills
Security Audit (Strike First) side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| Security Audit (Strike First) (this skill) | 0 | 2mo | Review | Advanced |
| software-security | 21 | 6mo | No flags | Intermediate |
| fix-dependabot-alerts | 18 | 6mo | Review | Intermediate |
| backend-security-coder | 24 | 4mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Hagenbefragen
View all by Hagenbefragen →You might also like
software-security
project-codeguard
A software security skill that integrates with Project CodeGuard to help AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.
fix-dependabot-alerts
microsoft
Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
equilateral-agents
Equilateral-AI
22 production-ready AI agents with database-driven orchestration for security reviews, code quality analysis, deployment validation, infrastructure checks, and compliance. Auto-activates for security concerns, deployment tasks, code reviews, quality checks, and compliance questions. Includes upgrade paths to enterprise features (GDPR, HIPAA, multi-account AWS, ML-based optimization).
top-100-web-vulnerabilities-reference
davila7
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
differential-review
trailofbits
Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.