Security Auditor

What it does

When your agent uses it

• Tasks that involve Web application vulnerabilities
• Tasks that involve Security review
• Tasks that involve Vulnerability scanning

Example prompts

• “security audit”
• “vulnerability scan”
• “secret detection”
• “/security-auditor”

Requirements

• Python 3
• A Bash shell
• Pre-approved tools (allowed-tools): Read, Write, Edit, Bash(npm audit:*,pip-audit:*,grep:*,find:*), Grep, Glob

Workflow steps

4 steps, taken from the step headings in SKILL.md.

1. 1Dependency Scanning
2. 2Secret Detection
3. 3OWASP Top 10 Static Analysis
4. 4Language-Specific Checks

What it can do on your machine

Read from SKILL.md and the folder at commit 6713fc7. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Write
  • Edit
  • Bash(npm audit:*
  • pip-audit:*
  • grep:*
  • find:*)
  • Grep
  • Glob

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 3 files in scripts/ (Shell and Python), which the agent can run.

  Shell commands in SKILL.md call:

  • npm
  • yarn
  • cargo

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • owasp.org

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Auditor loads about 2.2k tokens when it runs, and up to ~4.6k if it reads all its reference files. Until then it costs about 143 tokens; SKILL.md has 602 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~143

When it runs · the whole SKILL.md, loaded when a task matches

~2.2k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~4.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from curiositech/some_claude_skills at commit 6713fc7, republished under its MIT licence (© curiositech). 602 words, ~2,200 tokens.

name

security-auditor

description

Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).

allowed-tools

Read, Write, Edit, Bash(npm audit:*,pip-audit:*,grep:*,find:*), Grep, Glob

metadata.category

Code Quality & Testing

metadata.tags

security, owasp, vulnerabilities, sast, dependencies

# Run comprehensive scan
./scripts/full-audit.sh /path/to/project

# Output: security-report.json + summary

# Dependency vulnerabilities only
npm audit --json > deps-audit.json

# Secret detection only
./scripts/detect-secrets.sh /path/to/project

# OWASP check specific file
./scripts/owasp-check.py /path/to/file.js

Critical severity found?
├── YES → Block deployment, immediate fix required
│   └── Check if patch available → npm audit fix --force
├── NO → High severity?
    ├── YES → Fix within sprint, document if deferred
    └── NO → Low/Moderate → Track, fix during maintenance

Secret-like pattern found?
├── In test file? → Lower severity, document
├── In example/docs? → Check if placeholder
├── High entropy + near "password"/"secret" → High confidence
└── In .env.example? → Acceptable if placeholder values

{
  "summary": {
    "critical": 0,
    "high": 2,
    "medium": 5,
    "low": 12,
    "informational": 8
  },
  "findings": [
    {
      "id": "SEC-001",
      "severity": "high",
      "category": "A03:Injection",
      "title": "SQL Injection in user search",
      "location": "src/api/users.js:45",
      "description": "User input concatenated directly into SQL query",
      "evidence": "const query = `SELECT * FROM users WHERE name = '${input}'`",
      "remediation": "Use parameterized queries: db.query('SELECT * FROM users WHERE name = $1', [input])",
      "references": ["https://owasp.org/www-community/attacks/SQL_Injection"]
    }
  ],
  "recommendations": [
    "Implement parameterized queries across all database access",
    "Add input validation layer",
    "Enable SQL query logging for monitoring"
  ]
}

security-scan:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - name: Run security audit
      run: |
        npm audit --json > audit.json
        ./scripts/detect-secrets.sh . > secrets.json
        ./scripts/generate-report.py
    - name: Fail on critical
      run: |
        if jq '.summary.critical > 0' report.json; then
          echo "Critical vulnerabilities found!"
          exit 1
        fi

© curiositech, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (scripts, references) in .claude/skills/security-auditor of curiositech/some_claude_skills.

• SKILL.md
• .claude-plugin/plugin.json
• references/owasp-top-10-2024.md
• scripts/detect-secrets.sh
• scripts/full-audit.sh
• scripts/owasp-check.py

Open the folder on GitHubat commit 6713fc7