mcpField
A
auditing-security

auditing-security

github.com/spencerpaulySecurity868601 installsUpdated 13w ago
Repository

About auditing-security

A code-audit skill for security reviews, guiding checks for credentials, access control, injection, dependencies, and data exposure. It distinguishes code review from penetration testing.

Key features

  1. 01Scan source for hardcoded credentials
  2. 02Check authentication and authorization
  3. 03Review injection risks and dependency security
  4. 04Check security headers and data exposure
  5. 05Report findings with severity and fixes

Use cases

  1. 01Review application code for security issues
  2. 02Check access control on API routes
  3. 03Find sensitive data in logs or responses
  4. 04Document finding locations and remediation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/spencerpauly/awesome-cursor-skills --skill auditing-security

After installing, type/auditing-securityin Claude Code to confirm it loaded.

Details

From the project README

Security Audit

Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

Steps

  1. Scan for hardcoded secrets — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like:

    • password=, secret=, token=, api_key=
    • Base64-encoded credentials
    • AWS keys (AKIA...), Stripe keys (sk_live_...), GitHub tokens (ghp_...)
    • Files: .env committed to git, config.json with credentials

  2. Check authentication & authorization

    • Verify all API routes check authentication before processing.
    • Ensure role-based access control is enforced server-side, not just in the UI.
    • Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).
    • Verify session tokens are HTTP-only, secure, and have reasonable expiry.

  3. Check for injection vulnerabilities

    • SQL injection: look for string concatenation in SQL queries instead of parameterized queries.
    • XSS: look for dangerouslySetInnerHTML, innerHTML, or unescaped user input rendered in templates.
    • Command injection: look for exec(), eval(), child_process.exec() with user input.
    • Path traversal: check file operations for unsanitized user input in paths.

  4. Review dependency security

    • Run npm audit or pip audit to check for known vulnerabilities.
    • Flag outdated dependencies with known CVEs.
    • Check for overly permissive dependency ranges.

  5. Check CORS and CSP configuration

    • Verify CORS doesn't use Access-Control-Allow-Origin: * in production.
    • Check for Content Security Policy headers.
    • Verify X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security headers.

  6. Review data exposure

    • Check API responses for leaking sensitive fields (password hashes, internal IDs, PII).
    • Verify error messages don't expose stack traces or internal details in production.
    • Check logging for sensitive data being written to logs.

  7. Generate report — produce a summary with severity ratings (Critical / High / Medium / Low) for each finding, with the file path, line number, and recommended fix.

Notes

  • This is a code review, not a penetration test. Recommend tools like npm audit, trivy, or snyk for automated scanning.
  • Always check .gitignore to ensure .env, credentials, and key files are excluded.
  • For comprehensive auditing, recommend the OWASP Testing Guide.

Comments

Markdown supported