New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Security Audit

by davila7 in davila7/claude-code-templates

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

MITAuto-check passedSecurity

Install Security Audit

skills CLI
$ npx skills add davila7/claude-code-templates --skill security-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install davila7/claude-code-templates security-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/davila7/claude-code-templates.git skills-src && mkdir -p .claude/skills && cp -r skills-src/cli-tool/components/skills/security/security-audit .claude/skills/security-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security-audit
GitHub stars
32k
Used in
4 other repos
Token cost
~1.3k tokens
SKILL.md length
427 words
Files
1
Skills in repo
477
Repo updated
First seen
Licence
MIT

At a glance

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

  • Works in 7 steps: Reconnaissance → Vulnerability Scanning → Web Application Testing → …
  • Tasks that involve Security review
  • SKILL.md covers Overview, When to Use This Workflow, Workflow Phases and Security Testing Checklist, plus 2 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Security Audit is an agent skill from davila7/claude-code-templates. Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Security review, Penetration testing and Web application vulnerabilities. The repository describes itself as: CLI tool for configuring and monitoring Claude Code. The licence is MIT.

When your agent uses it

  • Tasks that involve Security review
  • Tasks that involve Penetration testing
  • Tasks that involve Web application vulnerabilities

Example prompts

  • “/security-audit”

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Reconnaissance
  2. Vulnerability Scanning
  3. Web Application Testing
  4. API Security Testing
  5. Penetration Testing
  6. Security Hardening
  7. Reporting

What it can do on your machine

Read from SKILL.md and the folder at commit 4c82aba. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Audit loads about 1.3k tokens when it runs. Until then it costs about 43 tokens; SKILL.md has 427 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~43
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from davila7/claude-code-templates at commit 4c82aba, republished under its MIT licence (© davila7). 427 words, ~1,299 tokens.

Download SKILL.mdSave it as .claude/skills/security-audit/SKILL.md (or your agent's skills folder).
name
security-audit
description
Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
category
workflow-bundle
risk
safe
source
personal
date_added
2026-02-27

Security Auditing Workflow Bundle

Overview

Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation.

When to Use This Workflow

Use this workflow when:

  • Performing security audits on web applications
  • Testing API security
  • Conducting penetration tests
  • Scanning for vulnerabilities
  • Hardening application security
  • Compliance security assessments

Workflow Phases

Phase 1: Reconnaissance
Skills to Invoke
  • scanning-tools - Security scanning
  • shodan-reconnaissance - Shodan searches
  • top-web-vulnerabilities - OWASP Top 10
Actions
  1. Identify target scope
  2. Gather intelligence
  3. Map attack surface
  4. Identify technologies
  5. Document findings
Copy-Paste Prompts
Use @scanning-tools to perform initial reconnaissance
Use @shodan-reconnaissance to find exposed services
Phase 2: Vulnerability Scanning
Skills to Invoke
  • vulnerability-scanner - Vulnerability analysis
  • security-scanning-security-sast - Static analysis
  • security-scanning-security-dependencies - Dependency scanning
Actions
  1. Run automated scanners
  2. Perform static analysis
  3. Scan dependencies
  4. Identify misconfigurations
  5. Document vulnerabilities
Copy-Paste Prompts
Use @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities
Use @security-scanning-security-dependencies to audit dependencies
Phase 3: Web Application Testing
Skills to Invoke
  • top-web-vulnerabilities - OWASP vulnerabilities
  • sql-injection-testing - SQL injection
  • xss-html-injection - XSS testing
  • broken-authentication - Authentication testing
  • idor-testing - IDOR testing
  • file-path-traversal - Path traversal
  • burp-suite-testing - Burp Suite testing
Actions
  1. Test for injection flaws
  2. Test authentication mechanisms
  3. Test session management
  4. Test access controls
  5. Test input validation
  6. Test security headers
Copy-Paste Prompts
Use @sql-injection-testing to test for SQL injection vulnerabilities
Use @xss-html-injection to test for cross-site scripting
Use @broken-authentication to test authentication security
Phase 4: API Security Testing
Skills to Invoke
  • api-fuzzing-bug-bounty - API fuzzing
  • api-security-best-practices - API security
Actions
  1. Enumerate API endpoints
  2. Test authentication/authorization
  3. Test rate limiting
  4. Test input validation
  5. Test error handling
  6. Document API vulnerabilities
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to fuzz API endpoints
Phase 5: Penetration Testing
Skills to Invoke
  • pentest-commands - Penetration testing commands
  • pentest-checklist - Pentest planning
  • ethical-hacking-methodology - Ethical hacking
  • metasploit-framework - Metasploit
Show full SKILL.md (178 more words)Show less
Actions
  1. Plan penetration test
  2. Execute attack scenarios
  3. Exploit vulnerabilities
  4. Document proof of concept
  5. Assess impact
Copy-Paste Prompts
Use @pentest-checklist to plan penetration test
Use @pentest-commands to execute penetration testing
Phase 6: Security Hardening
Skills to Invoke
  • security-scanning-security-hardening - Security hardening
  • auth-implementation-patterns - Authentication
  • api-security-best-practices - API security
Actions
  1. Implement security controls
  2. Configure security headers
  3. Set up authentication
  4. Implement authorization
  5. Configure logging
  6. Apply patches
Copy-Paste Prompts
Use @security-scanning-security-hardening to harden application security
Phase 7: Reporting
Skills to Invoke
  • reporting-standards - Security reporting
Actions
  1. Document findings
  2. Assess risk levels
  3. Provide remediation steps
  4. Create executive summary
  5. Generate technical report

Security Testing Checklist

OWASP Top 10
  • Injection (SQL, NoSQL, OS, LDAP)
  • Broken Authentication
  • Sensitive Data Exposure
  • XML External Entities (XXE)
  • Broken Access Control
  • Security Misconfiguration
  • Cross-Site Scripting (XSS)
  • Insecure Deserialization
  • Using Components with Known Vulnerabilities
  • Insufficient Logging & Monitoring
API Security
  • Authentication mechanisms
  • Authorization checks
  • Rate limiting
  • Input validation
  • Error handling
  • Security headers

Quality Gates

  • All planned tests executed
  • Vulnerabilities documented
  • Proof of concepts captured
  • Risk assessments completed
  • Remediation steps provided
  • Report generated
  • development - Secure development practices
  • wordpress - WordPress security
  • cloud-devops - Cloud security
  • testing-qa - Security testing

© davila7, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in cli-tool/components/skills/security/security-audit of davila7/claude-code-templates.

Open the folder on GitHubat commit 4c82aba

Used in 4 other repositories

We found 12 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 4 other GitHub owners. This page covers the copy in davila7/claude-code-templates, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Security Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security Audit compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security Audit this skilldavila7/claude-code-templates32k4 repos~1.3kAutomated safety check: PassMIT
Code Audit3stoneBrother/code-audit8931 repos~2.7kAutomated safety check: PassNone
Security AuditRightNow-AI/openfang18k—~858Automated safety check: PassApache-2.0
Security Auditoreigent-ai/eigent15k—~1.8kAutomated safety check: NotesApache-2.0
Strix Code Vulnerability Scanusestrix/strix67k—~1.1kAutomated safety check: PassApache-2.0
Wooyun Legacytanweai/wooyun-legacy1.8k—~1.9kAutomated safety check: PassCustom licence

Similar skills

  • Code Audit

    3stoneBrother/code-audit

    Professional code security audit skill covering 55+ vulnerability types.

    893 GitHub starsUsed in 1 repo~2.7k tokens
    SecurityAuto-check passed

  • Security Audit

    RightNow-AI/openfang

    Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology

    18k GitHub stars~858 tokensUpdated 3 mo ago
    SecurityAuto-check passed

  • Security Auditor

    eigent-ai/eigent

    Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

    15k GitHub stars~1.8k tokensUpdated today
    SecurityAuto-check: notes

  • Strix Code Vulnerability Scan

    usestrix/strix

    Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.

    67k GitHub stars~1.1k tokensUpdated today
    SecurityAuto-check passed

  • Wooyun Legacy

    tanweai/wooyun-legacy

    WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…

    1.8k GitHub stars~1.9k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Security Audit Scanner

    ruvnet/ruflo

    Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

    74k GitHub starsUsed in 2 repos~823 tokens
    SecurityAuto-check passed

More from davila7/claude-code-templates

All 477 skills in this repo

  • Perplexity Web Search

    davila7/claude-code-templates

    Runs web-grounded searches through Perplexity's Sonar models over OpenRouter for current events, recent literature and cited facts beyond the model's training cutoff.

    32k GitHub starsUsed in 12 repos~3.5k tokens
    Auto-check: notes

  • Neuropixels Data Analysis

    davila7/claude-code-templates

    Analyzes Neuropixels recordings from SpikeGLX or Open Ephys through preprocessing, drift correction, Kilosort4 spike sorting, quality metrics and curation.

    32k GitHub starsUsed in 10 repos~2.8k tokens
    Auto-check passed

  • Scientific Venue Templates

    davila7/claude-code-templates

    Supplies LaTeX templates and formatting rules for journals, conferences, posters, and grant proposals, then can check a draft against them.

    32k GitHub starsUsed in 9 repos~5.1k tokens
    Auto-check: notes

  • Brand Voice Content Creator

    davila7/claude-code-templates

    Analyzes a brand's existing writing to lock in a consistent voice, then builds SEO blog posts and platform-specific social content around it.

    32k GitHub starsUsed in 2 repos~1.9k tokens
    Auto-check passed

  • CAPA Officer

    davila7/claude-code-templates

    Guides corrective and preventive action (CAPA) work in a quality management system, from initiation and root cause analysis through effectiveness verification.

    32k GitHub starsUsed in 1 repo~2k tokens
    Auto-check passed

  • Fda Consultant Specialist

    davila7/claude-code-templates

    Senior FDA consultant and specialist for medical device companies including HIPAA compliance and requirement management.

    32k GitHub starsUsed in 1 repo~2.7k tokens
    Auto-check passed

Categories

Questions about Security Audit

What does Security Audit do?

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening. Security Audit is an agent skill from davila7/claude-code-templates. Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

When should I use Security Audit?

Security Audit fits situations like: tasks that involve Security review; tasks that involve Penetration testing; tasks that involve Web application vulnerabilities.

How do I install Security Audit in Claude Code?

Run `npx skills add davila7/claude-code-templates --skill security-audit -a claude-code`. Or copy the skill folder (cli-tool/components/skills/security/security-audit in davila7/claude-code-templates) into .claude/skills/security-audit in your project. Claude Code loads it when a task matches its description.

How do I install Security Audit in Codex?

Run `npx skills add davila7/claude-code-templates --skill security-audit -a codex`. Or copy the skill folder (cli-tool/components/skills/security/security-audit in davila7/claude-code-templates) into .agents/skills/security-audit in your project. Codex loads it when a task matches its description.

Can I use Security Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add davila7/claude-code-templates --skill security-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-audit, .gemini/skills/security-audit, .github/skills/security-audit and .opencode/skills/security-audit in your project.

What does Security Audit need to run?

SKILL.md names no scripts, command-line tools or credentials: Security Audit is instructions for the agent only.

Does Security Audit access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Security Audit safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Security Audit use?

Security Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security Audit use?

About 1.3k tokens (SKILL.md is roughly 5.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security Audit?

Skills that share tags, products or a category with Security Audit: Code Audit (3stoneBrother/code-audit, 893 stars), Security Audit (RightNow-AI/openfang, 18k stars), Security Auditor (eigent-ai/eigent, 15k stars) and Strix Code Vulnerability Scan (usestrix/strix, 67k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security Audit?

davila7 (a GitHub user) maintains it in davila7/claude-code-templates, which has 32,432 GitHub stars. The repository holds 477 skills in this directory. The repository was last updated on October 7, 2026.

Source: davila7/claude-code-templates on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.