SkillsAdd

netresearch/security-audit-skill

security-audit

Use when conducting security assessments — OWASP Top 10 / API / LLM, CWE Top 25, CVSS scoring — auditing PHP/TYPO3, APIs, frontend, Terraform/K8s/Docker IaC, AWS cloud, AI agent configs, or scanning dependencies.

First seen Feb 8, 2026

Installation

$ npx skills add netresearch/security-audit-skill --skill security-audit
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

find-skills Same topic
vercel-labs/skills

Helps users discover and install agent skills when they ask questions like "how do I do X", "fi…

3.3M installs
agent-browser Same topic
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
vercel-react-best-practices Same topic
vercel-labs/agent-skills 697.8K installs
web-design-guidelines Same topic
vercel-labs/agent-skills

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "chec…

617.3K installs
microsoft-foundry Same topic
microsoft/azure-skills

Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and …

576.5K installs
azure-prepare Same topic
microsoft/azure-skills

Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Te…

568.3K installs
More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 40
License LICENSE-CC-BY-SA-4.0
Default branch main
Open issues 1
Status Active

Skill metadata

Parsed from SKILL.md frontmatter.

Version2.11.2
License(MIT AND CC-BY-SA-4.0). See LICENSE-MIT and LICENSE-CC-BY-SA-4.0
CompatibilityRequires grep, jq, gh CLI.
Allowed toolsBash(grep:*) Bash(jq:*) Bash(gh:*) Read Glob Grep
Declared agents claude-code
More metadata
author
Netresearch DTT GmbH
version
2.11.2
repository
https://github.com/netresearch/security-audit-skill

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 3,441 B
  • docs SUMMARY.md 238 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 516 installs

SKILL.md

Security Audit Skill

Security audit patterns (OWASP Top 10, LLM Top 10 2025, CWE Top 25 2025, CVSS v4.0), cloud/IaC, GitHub security. 80+ PHP/TYPO3 checkpoints (v14.3 LTS in typo3-security.md).

Expertise Areas

  • Vulnerabilities: XXE, SQLi, XSS, CSRF, command injection, path traversal, file upload, deserialization, SSRF, SSTI, JWT, type juggling
  • Standards: OWASP Top 10 / API / LLM (2025), CWE Top 25, CVSS v3.1/v4.0, OWASP ASVS
  • Cloud & IaC: AWS; Terraform, Kubernetes, Docker, Helm
  • API & Frontend: REST/GraphQL authZ, rate limits, mass assignment, CSP, DOM-XSS
  • AI Agents: SKILL.md/AGENTS.md/CLAUDE.md/mcp.json/hooks.json audit; prompt injection; excessive agency

Reference Files (in references/, .md implied)

  • Core: owasp-top10, cwe-top25, xxe-prevention, cvss-scoring, api-key-encryption
  • Prevention: deserialization-prevention, path-traversal-prevention, file-upload-security, input-validation, error-message-sanitization
  • Architecture: authentication-patterns, security-headers, security-logging, cryptography-guide, security-invariants, indistinguishability-defences
  • Language features (*-security-features): php, python, javascript-typescript, nodejs, go
  • Frameworks (*-security): typo3, typo3-fluid, typo3-typoscript, symfony, react, vue
  • Cloud & IaC: aws-security, iac-security
  • API & Frontend: api-security, frontend-security
  • AI Agent: llm-security (OWASP LLM Top 10 2025)
  • Threats: modern-attacks, cve-patterns
  • DevSecOps: ci-security-pipeline, supply-chain-security, automated-scanning, gha-security, git-history-secrets
  • Incident: supply-chain-incident-response

Security Checklist

  • semgrep/opengrep, trivy fs --severity HIGH,CRITICAL, gitleaks clean
  • bcrypt/Argon2 passwords, CSRF on state changes, TLS 1.2+
  • Server-side input validation; parameterized SQL; XML entities off
  • Output encoding + CSP; no unserialize() on user input
  • API keys encrypted; exception messages sanitized
  • Secrets out of VCS; audit logging on
  • Uploads validated, renamed, outside web root
  • Headers HSTS + X-Content-Type-Options; dependencies scanned

GitHub Actions Security

  • NEVER interpolate ${{ inputs. }} / ${{ github.event. }} in run: — use env:
  • Dependency triage: upgrade > override > dismiss. Full patterns: references/gha-security.md.

Verification

./scripts/security-audit-dispatcher.sh /path/to/project  # auto-detect stack
./scripts/security-audit.sh /path/to/project             # PHP-only
./scripts/github-security-audit.sh owner/repo            # GH repo

Dispatcher detects the stack from indicator files and runs matching scripts/scanners/*.sh (13 ecosystems; see references/ index).

Contributing: https://github.com/netresearch/security-audit-skill