mcpField
S
security-audit

security-audit

github.com/srstompSecurity956 installsUpdated 4w ago
Repository

About security-audit

security-audit is a skill for reviewing application code, dependencies, configuration, architecture, and API security. It guides reviewers through scoping, severity classification, remediation, and reporting, while noting that it does not replace penetration testing.

Key features

  1. 01Reviews code against common vulnerabilities
  2. 02Checks dependencies for CVEs and outdated packages
  3. 03Audits configuration, architecture, and API security
  4. 04Classifies findings by severity
  5. 05Guides remediation and audit reporting

Use cases

  1. 01Reviewing a feature or pull request for security issues
  2. 02Checking dependencies before deployment
  3. 03Assessing secrets and permissions after infrastructure changes
  4. 04Evaluating API security for new endpoints

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/srstomp/pokayokay --skill security-audit

After installing, type/security-auditin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

references/
api-security.md
auth-patterns.md
dependency-security.md
owasp-top-10.md
secrets-management.md

Details

From the project README

Security Audit

Systematic security review for application code, dependencies, and configuration.

Not a replacement for professional penetration testing. Identifies common vulnerabilities within scope of code review.

Audit Types

TypeFocusWhen to Use
Code ReviewOWASP Top 10, injection, authNew features, PRs, suspicious code
DependencyCVEs, outdated packagesBefore deploy, periodic, CI/CD
ConfigurationSecrets, permissions, hardeningInfrastructure changes, new envs
ArchitectureAttack surface, data flowDesign phase, major refactors
API SecurityAuth, authz, rate limitingNew endpoints, public APIs

When NOT to Use

  • Designing new auth flows — Use api-design for designing OAuth2/JWT endpoints from scratch
  • Performance issues — Use observability to diagnose latency and resource problems, even if caused by auth overhead
  • CI/CD pipeline security — Use ci-cd for pipeline hardening (secret management, permissions)

Key Principles

  • Scope first — Define audit area, depth, and constraints before scanning
  • Classify severity — Critical (24-48h), High (1 week), Medium (2-4 weeks), Low (backlog)
  • Remediate or track — Fix critical issues immediately, create ohno tasks for the rest
  • No secrets in code — Scan for hardcoded credentials, API keys, connection strings

Quick Start Checklist

  1. Define audit scope and type (code, dependency, config, architecture, API)
  2. Run automated scans (npm audit, grep patterns, secret detection)
  3. Review findings and classify severity using decision tree in references
  4. Remediate critical/high findings immediately
  5. Create ohno tasks for medium/low findings with appropriate priority
  6. Document findings in audit report

References

ReferenceDescription
owasp-top-10.mdOWASP vulnerabilities with detection and fixes
dependency-security.mdnpm audit, pip-audit, Snyk, CI/CD integration
auth-patterns.mdSecure authentication and authorization patterns
api-security.mdAPI-specific security concerns
secrets-management.mdHandling sensitive configuration

Runtime Notes

  • Claude Code: dispatch yokay-security-scanner via the Task tool with subagent_type: "pokayokay:yokay-security-scanner".
  • Codex: there is no subagent dispatch. Execute the agent's role inline — read the corresponding agents/yokay-<name>.md and follow its Behavioral Defaults, Critical Rules, and Output Contract directly in the current session.

Comments

Markdown supported