About workflow-security-audit
A security-audit workflow skill for agents conducting assessments from threat modeling through remediation and compliance checks. It structures scanning, review, testing, validation, and documentation into nine phases.
Key features
- 01Nine-phase security audit process
- 02Threat modeling and risk prioritization
- 03Automated dependency, code, and secret scans
- 04Manual review and penetration testing
- 05Remediation planning and fix validation
- 06Compliance checks and audit documentation
Use cases
- 01Assessing application and infrastructure risks
- 02Finding vulnerabilities through scans and code review
- 03Planning and validating security fixes
- 04Preparing audit and compliance documentation
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/workflow-security-auditin Claude Code to confirm it loaded.
Details
From the project READMESecurity Audit Workflow
Comprehensive security assessment process.
Phase 1: Threat Assessment
Agents: security-auditor
Scope:
- Authentication & authorization
- Data protection
- API security
- Dependency vulnerabilities
- Infrastructure security
Output: Threat model, risk assessment, priority list
Phase 2: Automated Scanning
Agents: security-auditor
Tools to run:
- Dependency check (npm audit, pip-audit, cargo audit)
- Static analysis (semgrep, bandit, etc.)
- Secret scanning (trufflehog, gitleaks)
Output: Vulnerability report with severity ratings
Phase 3: Manual Code Review
Agents: security-auditor
Focus areas:
- Input validation
- Output encoding
- Authentication logic
- Authorization checks
- Cryptography usage
- Session management
Phase 4: Penetration Testing
Agents: security-auditor
Test for:
- SQL injection
- XSS attacks
- CSRF attacks
- Authentication bypass
- Privilege escalation
Phase 5: Remediation Planning
Agents: requirements-analyst
- Create fix tasks from vulnerability report
- Prioritize by severity
- Estimate timeline
- Allocate resources
Phase 6: Fix Implementation
Blocking: Validation required before proceeding
Phase 7: Security Validation
Agents: security-auditor
- Retest all identified vulnerabilities
- Regression checks
- Verify fixes don't introduce new issues
Phase 8: Documentation
Agents: technical-writer
- Security audit report
- Compliance documentation
- Security best practices guide
Phase 9: Compliance Check
Agents: security-auditor
Standards:
- OWASP Top 10
- GDPR (if applicable)
- SOC2 (if applicable)
- HIPAA (if applicable)
Success Criteria
- All critical vulnerabilities fixed
- All high vulnerabilities fixed
- Compliance requirements met
- Security tests pass
Severity Levels
| Level | Response Time | Examples |
|---|---|---|
| Critical | Immediate | RCE, auth bypass, data breach |
| High | 24-48h | SQL injection, privilege escalation |
| Medium | 1 week | XSS, CSRF, information disclosure |
| Low | Next sprint | Best practice violations |