Security Auditor Skill

Security reviews happen at the end of the project, under deadline pressure, by whoever is available. This skill treats security as a first-class pass — methodical, consistent, and not skipping the boring-looking parts where vulnerabilities actually hide.

What the skill does

• OWASP Top 10 coverage. Checks for injection (SQL, command, LDAP, XPath), broken authentication, sensitive data exposure, insecure direct object references, security misconfiguration, XSS, insecure deserialization, known vulnerable components, and insufficient logging.
• Secrets and credential scan. Flags hardcoded API keys, passwords, tokens, and connection strings — including ones that look like placeholders but are not.
• Authentication and authorisation. Reviews token handling, session management, password storage, rate limiting, and privilege escalation paths.
• Input validation. Checks where user input enters the system and whether it is sanitised, validated, and escaped at every boundary.
• Severity ratings. Each finding is rated Critical / High / Medium / Low with a CVSS-aligned rationale.
• Fix recommendations. Every finding comes with a concrete remediation step, not just a description of the problem.

How it works

1. Share the code. Paste a file, a function, a route handler, or a complete feature — the more context, the more thorough the audit.
2. Specify the stack. Tell the skill the language, framework, and what the code does (handles auth, processes payments, parses user uploads, etc.).
3. Audit pass. The skill works through the code systematically — input paths first, then data handling, then output, then configuration.
4. Findings report. Each finding includes the location, the vulnerability class, the attack scenario, the severity, and the fix.
5. Remediation walkthrough. Ask the skill to write the fixed version of any flagged section.

How to use it

1. Click ⬇ Download this Claude Skill above.
2. Import through Claude Desktop (Customize → Skills → + → Create skill → Upload a skill) or drop into .claude/commands/. Full walkthrough in the import tutorial.
3. Invoke and paste your code:

   /security-auditor
   

   Or specify the focus area:

   /security-auditor Node.js Express API. Focus on the authentication middleware and the file upload handler.
   

---

Quick-start prompt (no download)

You are a senior application security engineer. Conduct a thorough security audit of the following code.

For each finding provide:

• Location (file/function/line if identifiable)
• Vulnerability class (OWASP category or CWE ID)
• Attack scenario — how would an attacker exploit this?
• Severity: Critical / High / Medium / Low with rationale
• Remediation: the specific change needed, with a code example

Check specifically for: SQL/command/XSS injection, hardcoded secrets, broken auth/session handling, insecure direct object references, missing input validation, unsafe deserialization, and verbose error messages leaking internals.

Stack: [language + framework]. This code handles: [describe what it does].

[paste code here]

Tips:

• Run the audit on the code that handles authentication, file uploads, and external API calls first — these are the highest-risk entry points.
• Ask for a "fix this finding" follow-up on any Critical or High item to get a drop-in replacement.
• For dependency audits, paste your package.json, requirements.txt, or go.mod and ask for known CVE exposure.
• Ask for a threat model if you want a higher-level picture before diving into code-level findings.

⚠ This skill has been tested and optimized for Claude. Results may vary with other AI assistants.