Agent skill

Common Security Audit

by HoangNguyen0403 in HoangNguyen0403/agent-skills-standard

Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular…

MITAuto-check passedSecurity

Install Common Security Audit

skills CLI

$ npx skills add HoangNguyen0403/agent-skills-standard --skill common-security-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install HoangNguyen0403/agent-skills-standard common-security-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/HoangNguyen0403/agent-skills-standard.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/common/common-security-audit .claude/skills/common-security-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "common-security-audit" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/skills/common/common-security-audit into .claude/skills/common-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "common-security-audit", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/skills/common/common-security-audit

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add HoangNguyen0403/agent-skills-standard --skill common-security-audit -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install HoangNguyen0403/agent-skills-standard common-security-audit --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/HoangNguyen0403/agent-skills-standard.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/common/common-security-audit .agents/skills/common-security-audit && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "common-security-audit" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/skills/common/common-security-audit into .agents/skills/common-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "common-security-audit", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add HoangNguyen0403/agent-skills-standard --skill common-security-audit -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install HoangNguyen0403/agent-skills-standard common-security-audit --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/HoangNguyen0403/agent-skills-standard.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/common/common-security-audit .cursor/skills/common-security-audit && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "common-security-audit" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/skills/common/common-security-audit into .cursor/skills/common-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "common-security-audit", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/HoangNguyen0403/agent-skills-standard.git --path skills/common/common-security-audit

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add HoangNguyen0403/agent-skills-standard --skill common-security-audit -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install HoangNguyen0403/agent-skills-standard common-security-audit --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/HoangNguyen0403/agent-skills-standard.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/common/common-security-audit .gemini/skills/common-security-audit && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "common-security-audit" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/skills/common/common-security-audit into .gemini/skills/common-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "common-security-audit", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install HoangNguyen0403/agent-skills-standard common-security-audit

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add HoangNguyen0403/agent-skills-standard --skill common-security-audit -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/HoangNguyen0403/agent-skills-standard.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/common/common-security-audit .github/skills/common-security-audit && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "common-security-audit" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/skills/common/common-security-audit into .github/skills/common-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "common-security-audit", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add HoangNguyen0403/agent-skills-standard --skill common-security-audit -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install HoangNguyen0403/agent-skills-standard common-security-audit --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/HoangNguyen0403/agent-skills-standard.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/common/common-security-audit .opencode/skills/common-security-audit && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "common-security-audit" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/skills/common/common-security-audit into .opencode/skills/common-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "common-security-audit", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: common-security-audit
GitHub stars: 572
Token cost: ~977 tokens
SKILL.md length: 354 words
Files: 8 (incl. references)
Skills in repo: 211
Repo updated: Oct 9, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular…

Works in 8 steps: Scan for Hardcoded Secrets → Detect Data Leakage in Logs → Map Injection Surfaces & Auth Coverage → …
Performing security audits
SKILL.md covers Priority: P0 (CRITICAL), 1. Scan for Hardcoded Secrets, 2. Detect Data Leakage in Logs and 3. Map Injection Surfaces &…, plus 9 more sections
Calls npm, cargo and go

What it does

Common Security Audit is an agent skill from HoangNguyen0403/agent-skills-standard. Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue), and mobile (iOS, Android, Flutter) codebases. Use when performing security audits, vulnerability scans, secrets detection, or penetration testing.

Its SKILL.md is about 980 tokens, which your agent loads only when the skill is triggered. The skill folder holds 9 other files, including reference files (for example `evals/evals.json`, `references/REMEDIATION.md` and `references/implementation.md`).

It sits in Security, covering Security review, Secrets management and Cross-platform mobile apps. It works with React, Java, Python and Rust. The repository describes itself as: A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages. The licence is MIT.

When your agent uses it

Performing security audits
Vulnerability scans
Secrets detection
Penetration testing

Example prompts

“/common-security-audit”

Requirements

Docker

Workflow steps

8 steps, taken from the step headings in SKILL.md.

Scan for Hardcoded Secrets
Detect Data Leakage in Logs
Map Injection Surfaces & Auth Coverage
Run Dependency CVE Scans
Infrastructure & Adversarial Entry Points
Frontend-Specific Audit
Mobile-Specific Audit
Business Logic & Advanced Attacks

What it can do on your machine

Read from SKILL.md and the folder at commit b529c2d. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- npm
- cargo
- go
- dart
- mvn
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Common Security Audit loads about 977 tokens when it runs, and up to ~5.3k if it reads all its reference files. Until then it costs about 92 tokens; SKILL.md has 354 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~92
When it runs · the whole SKILL.md, loaded when a task matches: ~977
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~5.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from HoangNguyen0403/agent-skills-standard at commit b529c2d, republished under its MIT licence (© HoangNguyen0403). 354 words, ~977 tokens.

Download SKILL.mdSave it as .claude/skills/common-security-audit/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.

name: common-security-audit
description: Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue), and mobile (iOS, Android, Flutter) codebases. Use when performing security audits, vulnerability scans, secrets detection, or penetration testing.

Security Audit

Priority: P0 (CRITICAL)

1. Scan for Hardcoded Secrets

See implementation examples for secrets scanning commands.

Covers: Backend source, frontend bundles (REACT_APP_, NEXT_PUBLIC_, VITE_), mobile configs (BuildConfig, iOS configurations, strings.xml).

2. Detect Data Leakage in Logs

See implementation examples for log leakage scanning commands across Node, Go, Dart, Java, Swift.

3. Map Injection Surfaces & Auth Coverage

See implementation examples for injection detection and auth coverage measurement.

4. Run Dependency CVE Scans

Node/Python/Rust: npm audit --audit-level=high | pip-audit | cargo audit
Go/Dart: go list -m -u all | dart pub outdated --json
Java/Mobile: mvn dependency:list / ./gradlew dependencies | pod audit / Gradle scan

5. Infrastructure & Adversarial Entry Points

See implementation examples for RCE/SSRF/Path Traversal and infrastructure hardening (Docker/K8s).

6. Frontend-Specific Audit

Exposed Secrets: grep -rE "(REACT_APP_|NEXT_PUBLIC_|VITE_)" . --include="*.ts*" --include="*.env*"
DOM Sinks & Source Maps: Check dangerouslySetInnerHTML, innerHTML, eval, and .map files in prod builds.

7. Mobile-Specific Audit

See mobile audit commands for insecure storage (credential stores/Keystore), cert pinning, debug flags, and deep links.

8. Business Logic & Advanced Attacks

BOLA/IDOR: Verify entity lookups always enforce tenant/owner ownership checks (e.g. any findById without an owner filter is a P0 IDOR vulnerability).
JWT / Mass Assignment: Check missing exp, weak keys, and uncontrolled property spread (...req.body).
Race / GraphQL: Verify atomic DB transactions, introspection disabled, and query depth limits.

Show full SKILL.md (147 more words)Show less

Scoring Impact

Finding	Threshold	Severity	Deduction
Hardcoded Secrets	Any match	P0	-25
Plain-text PII in Logs	Any match	P0	-20
Unguarded Routes > 20%	> 0.2	P0	-15
Raw SQL Concatenation	Any match	P1	-10
Response Leakage (Stack)	> 0	P1	-10
Insecure Mobile Storage	Token in plaintext	P1	-15
Missing Cert Pinning	No pinning detected	P2	-8
DOM XSS Sinks	Any match	P1	-10

CAUTION: P0 finding immediately caps Security score at 40/100. Immediate actions for leaked secrets: rotate the credential NOW and purge from history.

Anti-Patterns

No applying generic patterns over project-specific rules: Respect existing security constraints.
No ignoring error handling or edge cases: Audit must cover boundary conditions.
No backend-only audit: Always check frontend AND mobile when in-scope.

References

Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:

Files

SKILL.md and 7 other files (references) in skills/common/common-security-audit of HoangNguyen0403/agent-skills-standard.

SKILL.md
evals/evals.json
references/REMEDIATION.md
references/implementation.md
references/mobile-audit.md
references/signals.md
references/trust-review-policy.md
references/vibe-security-scan.md

Open the folder on GitHubat commit b529c2d

Compare with similar skills

Common Security Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Common Security Audit compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Common Security Audit this skillHoangNguyen0403/agent-skills-standard	572	—	~977	Automated safety check: Pass	MIT	yesterday
Security Reviewgithub/awesome-copilot	40k	1 repos	~2.3k	Automated safety check: Notes	MIT	2 days ago
Code Review Skillawesome-skills/code-review-skill	2.1k	—	~2.8k	Automated safety check: Notes	MIT	1 mo ago
Code Review Excellenceandrew-yangy/gru-ai	155	—	~1.7k	Automated safety check: Notes	MIT	7 mo ago
Folder Structure Blueprint Generatorgithub/awesome-copilot	40k	1 repos	~3.5k	Automated safety check: Pass	MIT	2 days ago
Screenmapaleqsio/screenmap	244	—	~7.2k	Automated safety check: Pass	MIT	6 days ago

Similar skills

Security Review
github/awesome-copilot
Official
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…
40k GitHub starsUsed in 1 repo~2.3k tokens
SecurityAuto-check: notes
Code Review Skill
awesome-skills/code-review-skill
Provides comprehensive code review guidance for React 19, Vue 3, Angular 17+, Svelte 5, Rust, TypeScript, Java, Java 8, PHP, Ruby, Rails, Python, Django, FastAPI, Go, C/.NET, Kotlin, Swift, Dart…
2.1k GitHub stars~2.8k tokensUpdated 1 mo ago
DevelopmentAuto-check: notes
Code Review Excellence
andrew-yangy/gru-ai
Provides comprehensive code review guidance for React 19, Vue 3, Rust, TypeScript, Java, Python, and C/C++.
155 GitHub stars~1.7k tokensUpdated 7 mo ago
DevelopmentAuto-check: notes
Folder Structure Blueprint Generator
github/awesome-copilot
Official
Comprehensive technology-agnostic prompt for analyzing and documenting project folder structures.
40k GitHub starsUsed in 1 repo~3.5k tokens
Productivity & AutomationAuto-check passed
Screenmap
aleqsio/screenmap
Generate a visual navigation map of an Expo / React Native or NativeScript app.
244 GitHub stars~7.2k tokensUpdated 6 days ago
MobileAuto-check passed
Code Review Skill
Rain-kl/OpenFlare
Provides comprehensive code review guidance for React 19, Vue 3, Angular 17+, Svelte 5, Rust, TypeScript, Java, PHP, Python, Django, Go, C/.NET, Kotlin, Swift, NestJS, C/C++, and more.
289 GitHub stars~2.3k tokensUpdated 3 days ago
DevelopmentAuto-check: notes

Questions about Common Security Audit

What does Common Security Audit do?

Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular…. Common Security Audit is an agent skill from HoangNguyen0403/agent-skills-standard. Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue), and mobile (iOS, Android, Flutter) codebases.

When should I use Common Security Audit?

Common Security Audit fits situations like: performing security audits; vulnerability scans; secrets detection; penetration testing.

How do I install Common Security Audit in Claude Code?

Run `npx skills add HoangNguyen0403/agent-skills-standard --skill common-security-audit -a claude-code`. Or copy the skill folder (skills/common/common-security-audit in HoangNguyen0403/agent-skills-standard) into .claude/skills/common-security-audit in your project. Claude Code loads it when a task matches its description.

How do I install Common Security Audit in Codex?

Run `npx skills add HoangNguyen0403/agent-skills-standard --skill common-security-audit -a codex`. Or copy the skill folder (skills/common/common-security-audit in HoangNguyen0403/agent-skills-standard) into .agents/skills/common-security-audit in your project. Codex loads it when a task matches its description.

Can I use Common Security Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add HoangNguyen0403/agent-skills-standard --skill common-security-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/common-security-audit, .gemini/skills/common-security-audit, .github/skills/common-security-audit and .opencode/skills/common-security-audit in your project.

What does Common Security Audit need to run?

Going by SKILL.md and its folder, Common Security Audit needs the command-line tools its instructions call (npm, cargo, go, dart and mvn). Our summary lists: Docker.

Does Common Security Audit access the network?

SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Common Security Audit safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Common Security Audit use?

Common Security Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Common Security Audit use?

About 977 tokens (SKILL.md is roughly 3.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 4.3k tokens, read only when the agent opens those files.

What are the alternatives to Common Security Audit?

Skills that share tags, products or a category with Common Security Audit: Security Review (github/awesome-copilot, 40k stars), Code Review Skill (awesome-skills/code-review-skill, 2.1k stars), Code Review Excellence (andrew-yangy/gru-ai, 155 stars) and Folder Structure Blueprint Generator (github/awesome-copilot, 40k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Common Security Audit?

HoangNguyen0403 (a GitHub user) maintains it in HoangNguyen0403/agent-skills-standard, which has 572 GitHub stars. The repository holds 211 skills in this directory. The repository was last updated on October 9, 2026.

Source: HoangNguyen0403/agent-skills-standard on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Common Security Audit

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Security Audit

Priority: P0 (CRITICAL)

1. Scan for Hardcoded Secrets

2. Detect Data Leakage in Logs

3. Map Injection Surfaces & Auth Coverage

4. Run Dependency CVE Scans

5. Infrastructure & Adversarial Entry Points

6. Frontend-Specific Audit

7. Mobile-Specific Audit

8. Business Logic & Advanced Attacks

Scoring Impact

Anti-Patterns

References

Canonical response anchors

Files

Compare with similar skills

Similar skills

More from HoangNguyen0403/agent-skills-standard

Related

Questions about Common Security Audit