mcpField
S
security-audit

security-audit

github.com/dirnbauerSecurity3383 installsUpdated 14w ago
Repository

About security-audit

A security-audit skill for codebases and GitHub repositories, with guidance on vulnerabilities, cloud and IaC, APIs, and AI agent security. Its scripts detect the project stack and run matching scanners.

Key features

  1. 01OWASP, CWE, and CVSS guidance
  2. 02Cloud and IaC configuration checks
  3. 03API, frontend, and AI agent reviews
  4. 04Stack-aware scanner dispatch
  5. 05PHP and TYPO3 checkpoints

Use cases

  1. 01Reviewing a project for common vulnerabilities
  2. 02Auditing GitHub Actions workflow security
  3. 03Scanning cloud infrastructure and dependencies
  4. 04Assessing AI agent configuration risks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/dirnbauer/webconsulting-skills --skill security-audit

After installing, type/security-auditin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

checkpoints.yaml
evals/
evals.json
references/
android-sdk-security.md
angular-security.md
api-key-encryption.md
api-security.md
authentication-patterns.md
automated-scanning.md
aws-security.md
azure-security.md
blazor-security.md
ci-security-pipeline.md
cryptography-guide.md
csharp-security-features.md
cve-database.md
cve-patterns.md
cvss-scoring.md
cwe-top25.md
deserialization-prevention.md
django-security.md
dotnet-security.md
error-message-sanitization.md
express-security.md
fastapi-security.md
file-upload-security.md
flask-security.md
framework-security.md
frontend-security.md
gcp-security.md
gha-security.md

Details

From the project README

Security Audit Skill

Security audit patterns (OWASP Top 10, LLM Top 10 2025, CWE Top 25 2025, CVSS v4.0), cloud/IaC, GitHub security. 80+ PHP/TYPO3 checkpoints (v14.3 LTS in typo3-security.md).

Expertise Areas

  • Vulnerabilities: XXE, SQLi, XSS, CSRF, command injection, path traversal, file upload, deserialization, SSRF, SSTI, JWT, type juggling
  • Standards: OWASP Top 10 / API / LLM (2025), CWE Top 25, CVSS v3.1/v4.0, OWASP ASVS
  • Cloud & IaC: AWS; Terraform, Kubernetes, Docker, Helm
  • API & Frontend: REST/GraphQL authZ, rate limits, mass assignment, CSP, DOM-XSS
  • AI Agents: SKILL.md/AGENTS.md/CLAUDE.md/mcp.json/hooks.json audit; prompt injection; excessive agency

Reference Files (in references/, .md implied)

  • Core: owasp-top10, cwe-top25, xxe-prevention, cvss-scoring, api-key-encryption
  • Prevention: deserialization-prevention, path-traversal-prevention, file-upload-security, input-validation, error-message-sanitization
  • Architecture: authentication-patterns, security-headers, security-logging, cryptography-guide, security-invariants
  • Language features (*-security-features): php, python, javascript-typescript, nodejs, go
  • Frameworks (*-security): typo3, typo3-fluid, typo3-typoscript, symfony, react, vue
  • Cloud & IaC: aws-security, iac-security
  • API & Frontend: api-security, frontend-security
  • AI Agent: llm-security (OWASP LLM Top 10 2025)
  • Threats: modern-attacks, cve-patterns
  • DevSecOps: ci-security-pipeline, supply-chain-security, automated-scanning, gha-security, git-history-secrets
  • Incident: supply-chain-incident-response

Security Checklist

  • semgrep/opengrep, trivy fs --severity HIGH,CRITICAL, gitleaks clean
  • bcrypt/Argon2 passwords, CSRF on state changes, TLS 1.2+
  • Server-side input validation; parameterized SQL; XML entities off
  • Output encoding + CSP; no unserialize() on user input
  • API keys encrypted; exception messages sanitized
  • Secrets out of VCS; audit logging on
  • Uploads validated, renamed, outside web root
  • Headers HSTS + X-Content-Type-Options; dependencies scanned

GitHub Actions Security

  • NEVER interpolate ${{ inputs.* }} / ${{ github.event.* }} in run: — use env:
  • Dependency triage: upgrade > override > dismiss. Full patterns: references/gha-security.md.

Verification

./scripts/security-audit-dispatcher.sh /path/to/project  # auto-detect stack
./scripts/security-audit.sh /path/to/project             # PHP-only
./scripts/github-security-audit.sh owner/repo            # GH repo

Dispatcher detects the stack from indicator files and runs matching scripts/scanners/*.sh (13 ecosystems; see references/ index).

Contributing: https://github.com/netresearch/security-audit-skill

Credits & Attribution

This skill is based on the excellent work by Netresearch DTT GmbH.

Original repository: https://github.com/netresearch/security-audit-skill

Copyright (c) Netresearch DTT GmbH — Methodology and best practices (MIT / CC-BY-SA-4.0)

Special thanks to Netresearch DTT GmbH for their generous open-source contributions to the TYPO3 community, which helped shape this skill collection. Adapted by webconsulting.at for this skill collection

Comments

Markdown supported