mcpField
S
security-audit

security-audit

github.com/netresearchSecurity50735 installsUpdated 1d ago
Repository

About security-audit

security-audit is a security auditing skill for developers reviewing applications, cloud infrastructure, and GitHub repositories. It combines reference guidance with scripts that detect a project stack and run matching scanners, alongside focused PHP/TYPO3 checks.

Key features

  1. 01OWASP, CWE, and CVSS audit guidance
  2. 02Application and API vulnerability checks
  3. 03Cloud and IaC security references
  4. 04AI agent configuration audits
  5. 05Stack-detecting audit dispatcher
  6. 06PHP and GitHub audit scripts

Use cases

  1. 01Reviewing an application for common vulnerabilities
  2. 02Checking AWS or IaC security configurations
  3. 03Auditing AI agent files and hooks
  4. 04Running security checks on a GitHub repository

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/netresearch/security-audit-skill --skill security-audit

After installing, type/security-auditin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

checkpoints.yaml
evals/
evals.json
references/
api-key-encryption.md
api-security.md
authentication-patterns.md
automated-scanning.md
aws-security.md
ci-security-pipeline.md
cryptography-guide.md
cve-patterns.md
cvss-scoring.md
cwe-top25.md
deserialization-prevention.md
error-message-sanitization.md
file-upload-security.md
frontend-security.md
gha-security.md
git-history-secrets.md
go-security-features.md
iac-security.md
indistinguishability-defences.md
input-validation.md
javascript-typescript-security-features.md
llm-security.md
modern-attacks.md
nodejs-security-features.md
owasp-top10.md
path-traversal-prevention.md
php-security-features.md
python-security-features.md

Details

From the project README

Security Audit Skill

Security audit patterns (OWASP Top 10, LLM Top 10 2025, CWE Top 25 2025, CVSS v4.0), cloud/IaC, GitHub security. 80+ PHP/TYPO3 checkpoints (v14.3 LTS in typo3-security.md).

Expertise Areas

  • Vulnerabilities: XXE, SQLi, XSS, CSRF, command injection, path traversal, file upload, deserialization, SSRF, SSTI, JWT, type juggling
  • Standards: OWASP Top 10 / API / LLM (2025), CWE Top 25, CVSS v3.1/v4.0, OWASP ASVS
  • Cloud & IaC: AWS; Terraform, Kubernetes, Docker, Helm
  • API & Frontend: REST/GraphQL authZ, rate limits, mass assignment, CSP, DOM-XSS
  • AI Agents: SKILL.md/AGENTS.md/CLAUDE.md/mcp.json/hooks.json audit; prompt injection; excessive agency

Reference Files (in references/, .md implied)

  • Core: owasp-top10, cwe-top25, xxe-prevention, cvss-scoring, api-key-encryption
  • Prevention: deserialization-prevention, path-traversal-prevention, file-upload-security, input-validation, error-message-sanitization, ssh-forced-command-hardening
  • Architecture: authentication-patterns, security-headers, security-logging, cryptography-guide, security-invariants, indistinguishability-defences
  • Language features (*-security-features): php, python, javascript-typescript, nodejs, go
  • Frameworks (*-security): typo3, typo3-fluid, typo3-typoscript, symfony, react, vue
  • Cloud & IaC: aws-security, iac-security
  • API & Frontend: api-security, frontend-security
  • AI Agent: llm-security (OWASP LLM Top 10 2025)
  • Threats: modern-attacks, cve-patterns
  • DevSecOps: ci-security-pipeline, supply-chain-security, automated-scanning, gha-security, git-history-secrets
  • Incident: supply-chain-incident-response

Security Checklist

  • semgrep/opengrep, trivy fs --severity HIGH,CRITICAL, gitleaks clean
  • bcrypt/Argon2 passwords, CSRF on state changes, TLS 1.2+
  • Server-side input validation; parameterized SQL; XML entities off
  • Output encoding + CSP; no unserialize() on user input
  • API keys encrypted; exception messages sanitized
  • Secrets out of VCS; audit logging on
  • Uploads validated, renamed, outside web root
  • Headers HSTS + X-Content-Type-Options; dependencies scanned

GitHub Actions Security

  • NEVER interpolate ${{ inputs.* }} / ${{ github.event.* }} in run: — use env:
  • Dependency triage: upgrade > override > dismiss. Full patterns: references/gha-security.md.

Verification

./scripts/security-audit-dispatcher.sh /path/to/project  # auto-detect stack
./scripts/security-audit.sh /path/to/project             # PHP-only
./scripts/github-security-audit.sh owner/repo            # GH repo

Dispatcher detects the stack from indicator files and runs matching scripts/scanners/*.sh (13 ecosystems; see references/ index).

Contributing: https://github.com/netresearch/security-audit-skill

Comments

Markdown supported