mcpField
S
security-audit

security-audit

github.com/vladm3105Security1766 installsUpdated 1d ago
Repository

About security-audit

A security-audit skill for SDD projects that checks requirements and examines code, dependencies, infrastructure, and configuration. It combines vulnerability and compliance checks with STRIDE threat modeling to produce a prioritized report.

Key features

  1. 01Security requirement validation
  2. 02Code and secret scanning
  3. 03Infrastructure and dependency checks
  4. 04Compliance mapping
  5. 05STRIDE threat modeling
  6. 06Severity-ranked remediation report

Use cases

  1. 01Review an SDD project's security posture
  2. 02Find vulnerabilities and exposed secrets
  3. 03Check security requirements for completeness
  4. 04Prioritize compliance and threat-model findings

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/vladm3105/aidoc-flow-framework --skill security-audit

After installing, type/security-auditin Claude Code to confirm it loaded.

Details

From the project README

security-audit

Purpose

Ensure security requirements are properly defined, implemented, and tested, and identify vulnerabilities across code, dependencies, infrastructure, and configuration. Validates compliance against recognized standards (OWASP Top 10, CWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat modeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR security topics upstream of it.

When to Use

Use security-audit when:

  • Reviewing the security posture of an SDD project or its implementation.
  • Validating that security requirements in SPEC (and upstream EARS/ADR) are complete and testable.
  • Scanning code, dependencies, infrastructure, or configuration for vulnerabilities, secrets, or compliance gaps.
  • Performing threat modeling on a component or system.

Do not use it for general (non-security) artifact quality (use ../quality-advisor/SKILL.md) or traceability validation (use ../doc-validator/SKILL.md).

Behavior

The audit runs as a pipeline, producing a single report:

  1. Requirements validation — check security requirements (sourced from SPEC and upstream EARS/ADR) for completeness: authn/authz, data protection, encryption, key management; flag missing or vague requirements.
  2. Code scanning — SAST (bandit, semgrep), dependency CVEs (safety, pip-audit), secret detection (detect-secrets, gitleaks), and pattern checks for injection, XSS, and CSRF. Critical findings block deployment.
  3. Infrastructure scanning — IaC (checkov, tfsec), containers (trivy, grype), Kubernetes, and cloud/network configuration.
  4. Dependency assessment — known CVEs, CVSS scoring, outdated and transitive packages, and license-compliance issues.
  5. Compliance check — OWASP Top 10 (2021) coverage and CWE mapping, plus any applicable regulatory frameworks.
  6. Threat modeling — STRIDE analysis, attack-surface and trust-boundary mapping, with mitigation status per threat.
  7. Report — overall security score, findings grouped by severity (critical/high/medium/low) with file:line, CWE/CVE, CVSS, and fix, plus compliance status and prioritized remediation. Critical issues are marked as deployment blockers.

Targets: zero critical vulnerabilities, no secrets in the repository, 100% coverage of MUST security requirements, OWASP Top 10 fully covered.

Limitations: cannot detect all business-logic flaws, may produce false positives requiring manual review, and depends on current tool vulnerability databases.

Related Resources

  • SPEC layer: ${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/README.md · ${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/SPEC-TEMPLATE.yaml
  • Upstream security topics: ${CLAUDE_PLUGIN_ROOT}/framework/layers/03_EARS/README.md · ${CLAUDE_PLUGIN_ROOT}/framework/layers/05_ADR/README.md
  • Governance: ${CLAUDE_PLUGIN_ROOT}/framework/governance/ (ID, tagging, traceability standards)
  • Related skills: ../quality-advisor/SKILL.md · ../doc-validator/SKILL.md · ../doc-spec/SKILL.md
  • References: OWASP Top 10 (2021), CWE, OWASP ASVS

Comments

Markdown supported