mcpField
A
auditing-security

auditing-security

github.com/revitalb-portSecurity058 installsUpdated 10w ago
Repository

About auditing-security

A security-audit skill for reviewing application code for vulnerabilities and configuration risks. It covers secret exposure, authentication, injection, dependencies, headers, and data leaks, then produces findings with severity and recommended fixes.

Key features

  1. 01Search for hardcoded secrets
  2. 02Review authentication and authorization
  3. 03Check common injection risks
  4. 04Audit dependency security
  5. 05Inspect CORS and security headers
  6. 06Report severity and remediation

Use cases

  1. 01Reviewing an application before release
  2. 02Checking API routes and access controls
  3. 03Finding exposed credentials in a repository
  4. 04Prioritizing code security findings

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/revitalb-port/skills-registry-demo --skill auditing-security

After installing, type/auditing-securityin Claude Code to confirm it loaded.

Details

From the project README

Security Audit

Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

Steps

  1. Scan for hardcoded secrets — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like:

    • password=, secret=, token=, api_key=
    • Base64-encoded credentials
    • AWS keys (AKIA...), Stripe keys (sk_live_...), GitHub tokens (ghp_...)
    • Files: .env committed to git, config.json with credentials

  2. Check authentication & authorization

    • Verify all API routes check authentication before processing.
    • Ensure role-based access control is enforced server-side, not just in the UI.
    • Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).
    • Verify session tokens are HTTP-only, secure, and have reasonable expiry.

  3. Check for injection vulnerabilities

    • SQL injection: look for string concatenation in SQL queries instead of parameterized queries.
    • XSS: look for dangerouslySetInnerHTML, innerHTML, or unescaped user input rendered in templates.
    • Command injection: look for exec(), eval(), child_process.exec() with user input.
    • Path traversal: check file operations for unsanitized user input in paths.

  4. Review dependency security

    • Run npm audit or pip audit to check for known vulnerabilities.
    • Flag outdated dependencies with known CVEs.
    • Check for overly permissive dependency ranges.

  5. Check CORS and CSP configuration

    • Verify CORS doesn't use Access-Control-Allow-Origin: * in production.
    • Check for Content Security Policy headers.
    • Verify X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security headers.

  6. Review data exposure

    • Check API responses for leaking sensitive fields (password hashes, internal IDs, PII).
    • Verify error messages don't expose stack traces or internal details in production.
    • Check logging for sensitive data being written to logs.

  7. Generate report — produce a summary with severity ratings (Critical / High / Medium / Low) for each finding, with the file path, line number, and recommended fix.

Notes

  • This is a code review, not a penetration test. Recommend tools like npm audit, trivy, or snyk for automated scanning.
  • Always check .gitignore to ensure .env, credentials, and key files are excluded.
  • For comprehensive auditing, recommend the OWASP Testing Guide.

Comments

Markdown supported