Security Auditor
eigent-ai/eigent
Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.
A skill your agent uses when performing a cybersecurity audit, security review, OWASP Top 10 compliance check, vulnerability assessment, or preparing for a penetration test on a…
Install Owasp Security Audit
$ npx skills add LIDR-academy/AI4Devs-LTI-extended --skill owasp-security-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install LIDR-academy/AI4Devs-LTI-extended owasp-security-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/LIDR-academy/AI4Devs-LTI-extended.git skills-src && mkdir -p .claude/skills && cp -r skills-src/ai-specs/skills/owasp-security-audit .claude/skills/owasp-security-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "owasp-security-audit" agent skill from https://github.com/LIDR-academy/AI4Devs-LTI-extended/tree/main/ai-specs/skills/owasp-security-audit into .claude/skills/owasp-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-security-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/LIDR-academy/AI4Devs-LTI-extended/tree/main/ai-specs/skills/owasp-security-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add LIDR-academy/AI4Devs-LTI-extended --skill owasp-security-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install LIDR-academy/AI4Devs-LTI-extended owasp-security-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/LIDR-academy/AI4Devs-LTI-extended.git skills-src && mkdir -p .agents/skills && cp -r skills-src/ai-specs/skills/owasp-security-audit .agents/skills/owasp-security-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "owasp-security-audit" agent skill from https://github.com/LIDR-academy/AI4Devs-LTI-extended/tree/main/ai-specs/skills/owasp-security-audit into .agents/skills/owasp-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-security-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add LIDR-academy/AI4Devs-LTI-extended --skill owasp-security-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install LIDR-academy/AI4Devs-LTI-extended owasp-security-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/LIDR-academy/AI4Devs-LTI-extended.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/ai-specs/skills/owasp-security-audit .cursor/skills/owasp-security-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "owasp-security-audit" agent skill from https://github.com/LIDR-academy/AI4Devs-LTI-extended/tree/main/ai-specs/skills/owasp-security-audit into .cursor/skills/owasp-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-security-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/LIDR-academy/AI4Devs-LTI-extended.git --path ai-specs/skills/owasp-security-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add LIDR-academy/AI4Devs-LTI-extended --skill owasp-security-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install LIDR-academy/AI4Devs-LTI-extended owasp-security-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/LIDR-academy/AI4Devs-LTI-extended.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/ai-specs/skills/owasp-security-audit .gemini/skills/owasp-security-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "owasp-security-audit" agent skill from https://github.com/LIDR-academy/AI4Devs-LTI-extended/tree/main/ai-specs/skills/owasp-security-audit into .gemini/skills/owasp-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-security-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install LIDR-academy/AI4Devs-LTI-extended owasp-security-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add LIDR-academy/AI4Devs-LTI-extended --skill owasp-security-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/LIDR-academy/AI4Devs-LTI-extended.git skills-src && mkdir -p .github/skills && cp -r skills-src/ai-specs/skills/owasp-security-audit .github/skills/owasp-security-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "owasp-security-audit" agent skill from https://github.com/LIDR-academy/AI4Devs-LTI-extended/tree/main/ai-specs/skills/owasp-security-audit into .github/skills/owasp-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-security-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add LIDR-academy/AI4Devs-LTI-extended --skill owasp-security-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install LIDR-academy/AI4Devs-LTI-extended owasp-security-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/LIDR-academy/AI4Devs-LTI-extended.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/ai-specs/skills/owasp-security-audit .opencode/skills/owasp-security-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "owasp-security-audit" agent skill from https://github.com/LIDR-academy/AI4Devs-LTI-extended/tree/main/ai-specs/skills/owasp-security-audit into .opencode/skills/owasp-security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-security-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
owasp-security-audit- GitHub stars
- 278
- Token cost
- ~4.3k tokens
- SKILL.md length
- 1,704 words
- Files
- 1
- Skills in repo
- 9
- Repo updated
- First seen
- Licence
- MIT
At a glance
A skill your agent uses when performing a cybersecurity audit, security review, OWASP Top 10 compliance check, vulnerability assessment, or preparing for a penetration test on a…
- Works in 5 steps: Environment Setup and Automated Scans → Systematic Category Audit → Findings Classification → …
- Performing a cybersecurity audit
- SKILL.md covers Overview, When to Use, Audit Methodology and Quick Reference: OWASP Top 10…, plus 6 more sections
- Calls rg, npm and curl
What it does
Owasp Security Audit is an agent skill from LIDR-academy/AI4Devs-LTI-extended. Use when performing a cybersecurity audit, security review, OWASP Top 10 compliance check, vulnerability assessment, or preparing for a penetration test on a Node.js/Express/React application.
Its SKILL.md is about 4.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Web application vulnerabilities, Security review and Vulnerability scanning. It works with React and Node.js. The repository describes itself as: Repository with several experiments from live sessions. The licence is MIT.
When your agent uses it
- Performing a cybersecurity audit
- Security review
- OWASP Top 10 compliance check
- Vulnerability assessment
Example prompts
- “/owasp-security-audit”
Requirements
- Node.js
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 9ff9a80. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
rgnpmcurlgitpython3npx
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use npm, curl, git and npx, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Owasp Security Audit loads about 4.3k tokens when it runs. Until then it costs about 53 tokens; SKILL.md has 1,704 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteMentions a .env fileSKILL.md:41
| .gitignore check | Verify `.env`, `*.pem`, `*.key` are in `.gitignore` | A02: Committed secrets | - NoteMentions a .env fileSKILL.md:120
| `.env` in `.gitignore` | `rg '\.env' .gitignore` — verify NOT commented out | Critical | - NoteMentions a .env fileSKILL.md:362
trust `env()` in `schema.prisma` if the `.env` is committed
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from LIDR-academy/AI4Devs-LTI-extended at commit 9ff9a80, republished under its MIT licence (© LIDR-academy). 1,704 words, ~4,344 tokens.
Download SKILL.mdSave it as
.claude/skills/owasp-security-audit/SKILL.md (or your agent's skills folder).- name
- owasp-security-audit
- description
- Use when performing a cybersecurity audit, security review, OWASP Top 10 compliance check, vulnerability assessment, or preparing for a penetration test on a Node.js/Express/React application.
OWASP Top 10 Security Audit
Overview
Systematic methodology for auditing web applications against the OWASP Top 10:2021. Combines automated tooling with manual code review, produces a prioritized remediation plan with verification steps and CI/CD integration guidance.
Core principle: Every finding must be verified with tooling or code evidence, prioritized by exploitability, and paired with a concrete fix the agent can implement.
When to Use
- Cybersecurity audit or security review request
- OWASP Top 10 compliance assessment
- Pre-release security gate or penetration test preparation
- Post-incident security hardening
- Dependency vulnerability triage
When NOT to use:
- Quick fix for a single known vulnerability (just fix it)
- General code quality review (use
code-auditingskill instead) - Infrastructure/cloud security review (out of scope - this covers application layer)
Audit Methodology
Phase 0: Environment Setup and Automated Scans
Run automated tools FIRST - they catch low-hanging fruit before manual review.
Required scans (execute all):
| Tool | Command | Covers |
|---|---|---|
| npm audit | npm audit --json | A06: Known CVEs in dependencies |
| ESLint security | npx eslint --plugin security . | A03, A05: Code-level vulnerabilities |
| Outdated check | npm outdated | A06: Outdated packages |
| Secret scan | rg -i '(password|secret|api_key|token)\s*[:=]' --glob '!node_modules' --glob '!*.lock' | A02: Hardcoded secrets |
| .gitignore check | Verify .env, *.pem, *.key are in .gitignore | A02: Committed secrets |
| Git history secrets | git log --all --diff-filter=A -- '*.env' '*.pem' '*.key' | A02: Secrets in git history |
| Debug/telemetry code | rg 'fetch\(.*127\.0\.0\.1|localhost:[0-9]{4}' --glob '*.{ts,js,jsx,tsx}' | A04: Dev-only outbound requests |
Record baseline metrics: Total vulnerabilities by severity, outdated dependency count, secret scan hits.
Phase 1: Systematic Category Audit
Audit EVERY category using the checklist in the Quick Reference section. Do not skip categories even if they seem irrelevant - document "N/A" with justification.
For each category:
- Run the specific checks listed in the checklist
- Record findings with file path, line number, and severity
- Note what you checked even if clean (proves thoroughness)
Phase 2: Findings Classification
Rate each finding using this severity matrix:
| Severity | Criteria | Example |
|---|---|---|
| Critical | Exploitable remotely, no auth required, data breach likely | Hardcoded DB credentials in git, zero authentication |
| High | Exploitable with some effort, significant impact | Missing security headers, no rate limiting, IDOR |
| Medium | Requires specific conditions, moderate impact | Outdated dependencies without known exploits, weak validation |
| Low | Minimal impact or unlikely exploitation | Missing CSP fine-tuning, verbose error messages in dev |
Phase 3: Prioritized Remediation Plan
Group fixes into implementation phases:
Phase A - Immediate (< 1 day, critical/high):
- Rotate exposed credentials
- Add authentication middleware
- Install and configure Helmet
- Add rate limiting
- Fix
.gitignoreand purge secrets from git history
Phase B - Short-term (1-3 days, high/medium):
- Implement RBAC authorization
- Add input sanitization (xss/DOMPurify)
- Configure structured logging
- Set body size limits
- Add CSRF protection
Phase C - Medium-term (1-2 weeks, medium/low):
- Upgrade outdated dependencies
- Add CI/CD security pipeline
- Implement audit logging
- Add security monitoring/alerting
Each fix must include: what to change, where, a code example, and how to verify it works.
Phase 4: Verification and CI/CD Integration
For each remediation, define a verification step:
- Unit test that validates the security control
- curl command that proves the vulnerability is fixed
- CI pipeline check that prevents regression
Quick Reference: OWASP Top 10 Audit Checklist
A01: Broken Access Control
Step 1: Enumerate all routes first. Run rg 'router\.(get|post|put|patch|delete)' --glob '*.ts' and list every endpoint. Then verify EACH has auth middleware.
| Check | How | Severity if missing |
|---|---|---|
| Authentication middleware on ALL routes | Enumerate all routes, verify each has auth middleware in chain | Critical |
| RBAC / role-based authorization | Check for role checks before data access | Critical |
| IDOR protection | Verify resource ownership checks (e.g., where: { id, userId }) | High |
| CORS configuration | Check cors() options - no wildcard in production | High |
| Serverless CORS vs Express CORS | Compare serverless.yml CORS with Express CORS config | Medium |
| CSRF protection | Check for csurf or double-submit cookie pattern | Medium |
A02: Cryptographic Failures
| Check | How | Severity if missing |
|---|---|---|
| No hardcoded secrets | rg '(password|secret|key)\s*[:=]\s*["\x27]' --glob '!*.lock' | Critical |
.env in .gitignore | rg '\.env' .gitignore — verify NOT commented out | Critical |
| Secrets in git history | git log --all --diff-filter=A -- '*.env' '*.pem' — if found, recommend bfg-repo-cleaner purge | Critical |
Prisma uses env("DATABASE_URL") | Check schema.prisma datasource block — no inline connection string | Critical |
| HTTPS enforcement | Check for https redirects or HSTS headers | High |
| PII field filtering | Check API responses for unnecessary sensitive fields | Medium |
| Password hashing (if auth exists) | Verify bcrypt/argon2, not SHA/MD5 | Critical |
A03: Injection
| Check | How | Severity if missing |
|---|---|---|
| No raw SQL | rg '\$(queryRaw|executeRaw)|rawQuery' --glob '*.ts' | Critical |
| Parameterized queries (Prisma/ORM) | Verify all DB access through ORM, no string concatenation | Critical |
| Input validation on all endpoints | Check every route handler has validation before DB ops | High |
| File upload filename sanitization | Check multer/upload config for originalname usage | High |
| Sort/filter field allowlists | Verify user-supplied field names checked against allowlist | Medium |
No eval() or Function() | rg 'eval\(|new Function\(' --glob '*.{ts,js}' | Critical |
| No template literal injection in logs | Check log statements for unsanitized user input | Low |
| Mass assignment prevention | Verify req.body is NOT spread directly into Prisma create/update — use explicit field allowlists | High |
A04: Insecure Design
| Check | How | Severity if missing |
|---|---|---|
| Request body size limits | Check express.json({ limit: ... }) | Medium |
| File upload size/type restrictions | Check multer config for limits and fileFilter | High |
| File upload path traversal | Verify upload destination is absolute, filename is sanitized | High |
| Validation not bypassable | Check validators cannot be skipped (e.g., with extra fields) | High |
| No debug/telemetry endpoints in production | rg 'fetch\(.*127\.0\.0\.1|localhost:[0-9]' --glob '*.{ts,js,jsx}' | High |
| Error responses don't leak internals | Verify 500 errors return generic messages | Medium |
A05: Security Misconfiguration
| Check | How | Severity if missing |
|---|---|---|
| Helmet.js installed and configured | Check package.json for helmet, index.ts for app.use(helmet()) | High |
x-powered-by disabled | app.disable('x-powered-by') or Helmet handles it | Low |
| Rate limiting | Check for express-rate-limit or equivalent | High |
| Strict CORS (no wildcard) | Verify origin is not * or true | High |
| Environment variable validation | Check for startup validation of required env vars | Medium |
| No default credentials | Check seed files, test configs for hardcoded passwords | Medium |
| HTTP parameter pollution (HPP) | Check for hpp middleware or manual prevention | Low |
trust proxy configured (if behind LB) | Check app.set('trust proxy', ...) for Lambda/ALB | Medium |
| CSP for React SPA | Verify Content-Security-Policy header restricts script-src, style-src, connect-src | High |
No inline <script> in public HTML | Check public/index.html for inline scripts or event handlers | Medium |
Show full SKILL.md (708 more words)Show less
A06: Vulnerable and Outdated Components
| Check | How | Severity if missing |
|---|---|---|
npm audit clean | Run npm audit --json, count critical/high | Varies |
| Node.js runtime not EOL | Check engines field, Lambda runtime version | Medium |
| No deprecated packages | Run npm outdated, check for major version gaps | Low |
| Lock file exists and committed | Verify package-lock.json is in git | Medium |
| TypeScript version current | Check package.json TypeScript version | Low |
No suspicious postinstall scripts | Check dependencies for preinstall/postinstall scripts: rg '"preinstall|postinstall"' node_modules/*/package.json | head -20 | Medium |
| No typosquatting risk | Spot-check unusual or less-known package names against npm registry | Low |
A07: Identification and Authentication Failures
| Check | How | Severity if missing |
|---|---|---|
| Auth mechanism exists | rg 'jwt|jsonwebtoken|passport|auth|session' --glob '*.ts' -i | Critical |
| Password policy enforced | Check password validation (length, complexity) | High |
| Account lockout after failed attempts | Check for brute-force protection | High |
| Session/token expiration | Verify JWT expiry or session timeout | High |
| Secure cookie flags | Check httpOnly, secure, sameSite flags | Medium |
A08: Software and Data Integrity Failures
| Check | How | Severity if missing |
|---|---|---|
| HTML sanitization on text inputs | Check for xss, sanitize-html, or DOMPurify usage | Medium |
No dangerouslySetInnerHTML without sanitization | rg 'dangerouslySetInnerHTML' --glob '*.{tsx,jsx}' | High |
URL sanitization in href/src attributes | Check for javascript: protocol filtering | High |
| Prototype pollution prevention | Check for Object.freeze, --disable-proto flag, or hpp | Medium |
| Lock file integrity | Verify package-lock.json integrity hashes | Low |
A09: Security Logging and Monitoring Failures
| Check | How | Severity if missing |
|---|---|---|
| Structured logging (not console.log) | Check for winston, pino, or structured logger | High |
| Audit trail for CRUD operations | Verify create/update/delete actions are logged with actor | High |
| Request logging middleware order | Verify logger is BEFORE route handlers | Medium |
| No PII in error logs | Check error handlers for data leakage | Medium |
| Log injection prevention | Verify user input is not interpolated into log templates | Low |
| Failed auth attempt logging | Verify 401/403 responses are logged | Medium |
A10: Server-Side Request Forgery (SSRF)
| Check | How | Severity if missing |
|---|---|---|
| No outbound requests from user input | rg 'fetch\(|axios\.|http\.request' --glob 'backend/**/*.ts' | High |
| URL allowlist for external calls | Verify outbound URLs are validated against allowlist | High |
| No user-controlled redirect URLs | Check redirect endpoints for open redirect | Medium |
| File operations use absolute paths | Verify no path.join(userInput) without validation | Medium |
Serverless/Lambda Specific Checks
If the project deploys to AWS Lambda (or similar FaaS), also check:
| Check | How | Severity if missing |
|---|---|---|
| Lambda runtime not EOL | Check serverless.yml or template.yaml runtime version | Medium |
| IAM permissions least-privilege | Verify Lambda role has minimal permissions, not * | High |
| API Gateway CORS matches Express CORS | Compare gateway-level CORS with application-level | High |
| Environment variables encrypted at rest | Verify sensitive values use KMS encryption | Medium |
| Function timeout configured | Check for reasonable timeout to prevent resource exhaustion | Low |
| VPC configuration (if accessing private resources) | Verify Lambda is in VPC with proper security groups | Medium |
Runtime Verification Commands
After implementing fixes, verify with actual HTTP requests:
# Verify Helmet headers
curl -sI http://localhost:3010/ | grep -iE '(x-powered-by|x-content-type|strict-transport|x-frame)'
# Verify rate limiting
for i in $(seq 1 110); do curl -s -o /dev/null -w "%{http_code}\n" http://localhost:3010/; done | sort | uniq -c
# Verify CORS rejects unknown origins
curl -sI -H "Origin: http://evil.com" http://localhost:3010/ | grep -i access-control
# Verify body size limit
python3 -c "print('x'*2000000)" | curl -s -X POST -H "Content-Type: application/json" -d @- http://localhost:3010/candidates -w "\n%{http_code}"
# Verify auth required
curl -s http://localhost:3010/candidates -w "\n%{http_code}"Report Template
# OWASP Top 10 Security Audit Report
- **Project**: [name]
- **Stack**: [technologies]
- **Date**: [YYYY-MM-DD]
- **Scope**: Static code analysis + automated tooling
## Automated Scan Results
### npm audit
- Critical: X | High: X | Medium: X | Low: X
- Key vulnerabilities: [list]
### Secret Scan
- Hits: X
- Locations: [list]
## Findings by Category
### A01: Broken Access Control — [CRITICAL/HIGH/MEDIUM/LOW/CLEAN]
**Checked:** [list what was examined]
**Findings:** [list with file:line references]
**Remediation:** [code examples]
[...repeat for A02-A10...]
## Remediation Priority Matrix
| Phase | Finding | Severity | Effort | Fix |
|-------|---------|----------|--------|-----|
| A | [finding] | Critical | [hours] | [brief description] |
## Verification Checklist
- [ ] [Finding 1]: [how to verify fix]
- [ ] [Finding 2]: [how to verify fix]
## CI/CD Security Integration
- [ ] `npm audit` in CI pipeline (fail on critical/high)
- [ ] ESLint security plugin in pre-commit hook
- [ ] Dependency update bot (Dependabot/Renovate)
- [ ] Secret scanning in CI (truffleHog/gitleaks)Common Mistakes
| Mistake | Why it's wrong | Fix |
|---|---|---|
| Skipping categories marked "N/A" without evidence | Auditor assumed rather than verified | Always document what you checked |
| Not running automated tools | Missing known CVEs that are trivially exploitable | Run npm audit and secret scan FIRST |
| Reporting findings without remediation code | Findings without fixes create toil, not progress | Every finding needs a code-level fix |
| Not prioritizing fixes | Treating all findings equally paralyzes teams | Use the severity matrix and phase grouping |
| Forgetting CI/CD integration | Manual audits rot; only automated gates persist | Always include pipeline integration steps |
| Auditing only backend OR frontend | XSS vectors cross the boundary | Audit both, trace data flow end-to-end |
| Trusting ORM = no injection risk | ORMs prevent SQL injection but not all injection types | Check for command injection, log injection, path traversal |
Skipping .gitignore and git history check | Secrets removed from code may still be in git history | Check .gitignore AND git log history AND recommend purge if needed |
| Not checking for mass assignment | ORM prevents SQL injection but allows unfiltered field updates | Verify req.body is filtered through an allowlist before Prisma calls |
| Static analysis only | Some vulnerabilities only appear at runtime (CORS headers, rate limits) | Include runtime verification commands in the report |
Node.js/Express Specific Hardening Checklist
Essential middleware stack (order matters):
import helmet from 'helmet';
import rateLimit from 'express-rate-limit';
import cors from 'cors';
import hpp from 'hpp';
// 1. Security headers
app.use(helmet());
app.disable('x-powered-by');
// 2. Rate limiting
app.use(rateLimit({
windowMs: 15 * 60 * 1000,
max: 100,
standardHeaders: true,
legacyHeaders: false,
}));
// 3. CORS - explicit origins only
app.use(cors({
origin: process.env.ALLOWED_ORIGINS?.split(',') || [],
credentials: true,
methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
}));
// 4. Body parsing with size limits
app.use(express.json({ limit: '1mb' }));
app.use(express.urlencoded({ extended: true, limit: '1mb' }));
// 5. HTTP Parameter Pollution protection
app.use(hpp());
// 6. Request logging (BEFORE routes)
app.use(requestLogger);
// 7. Routes
app.use('/api', routes);
// 8. Error handler (AFTER routes, generic messages only)
app.use(errorHandler);Prisma/ORM Security Notes
- Always use
selectto limit returned fields (avoid PII leakage) - Never trust
env()inschema.prismaif the.envis committed - Watch for validation bypass when
idis present in request body - Prisma prevents SQL injection but NOT mass assignment - validate allowed fields explicitly
© LIDR-academy, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in ai-specs/skills/owasp-security-audit of LIDR-academy/AI4Devs-LTI-extended.
Open the folder on GitHubat commit 9ff9a80
Compare with similar skills
Owasp Security Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Owasp Security Audit this skillLIDR-academy/AI4Devs-LTI-extended | 278 | — | ~4.3k | Automated safety check: Notes | MIT | |
| Security Auditoreigent-ai/eigent | 15k | — | ~1.8k | Automated safety check: Notes | Apache-2.0 | |
| Code Audit3stoneBrother/code-audit | 892 | 1 repos | ~2.7k | Automated safety check: Pass | None | |
| Security Verification Gatefengshao1227/ccg-workflow | 5.9k | — | ~621 | Automated safety check: Notes | MIT | |
| Security Audit Scannerruvnet/ruflo | 74k | 1 repos | ~823 | Automated safety check: Pass | MIT | |
| Cyber NeoHainrixz/cyber-neo | 283 | — | ~5.9k | Automated safety check: Warn | MIT |
Similar skills
Code Audit
3stoneBrother/code-audit
Professional code security audit skill covering 55+ vulnerability types.
Security Verification Gate
fengshao1227/ccg-workflow
Scans code with a bundled Node script for injection, secrets, XSS and other risky patterns, ranks findings by severity and checks that security decisions are documented.
Security Audit Scanner
ruvnet/ruflo
Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.
Cyber Neo
Hainrixz/cyber-neo
Comprehensive cybersecurity analysis for any local project. An agent skill from Hainrixz/cyber-neo.
Code Vuln Audit
zebbern/claude-code-guide
Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection.
More from LIDR-academy/AI4Devs-LTI-extended
All 9 skills in this repoShow Spec Working
LIDR-academy/AI4Devs-LTI-extended
A skill your agent uses when the user asks "show me X", "demo X", "walk me through X", "how X works" or requests a live feature demonstration from a spec, feature or ticket.
Sync Agent Symlinks
LIDR-academy/AI4Devs-LTI-extended
Analyze and synchronize agent skill exposure after ai-specs skill changes (additions, removals, renames).
Run Parallel Tasks
LIDR-academy/AI4Devs-LTI-extended
Run N feature tasks in parallel, each in its own worktree, following the full specboot pipeline (enrich → new → ff → apply → verify).
Commit
LIDR-academy/AI4Devs-LTI-extended
Create focused commits and pull requests following repository standards.
Explain
LIDR-academy/AI4Devs-LTI-extended
Teach underlying concepts with clear mental models to close skill gaps behind user questions.
Enrich Us
LIDR-academy/AI4Devs-LTI-extended
Analyze and enhance Jira user stories with complete, implementation-ready technical detail.
Related
Categories
Questions about Owasp Security Audit
What does Owasp Security Audit do?
A skill your agent uses when performing a cybersecurity audit, security review, OWASP Top 10 compliance check, vulnerability assessment, or preparing for a penetration test on a…. Owasp Security Audit is an agent skill from LIDR-academy/AI4Devs-LTI-extended.js/Express/React application.
When should I use Owasp Security Audit?
Owasp Security Audit fits situations like: performing a cybersecurity audit; security review; OWASP Top 10 compliance check; vulnerability assessment.
How do I install Owasp Security Audit in Claude Code?
Run `npx skills add LIDR-academy/AI4Devs-LTI-extended --skill owasp-security-audit -a claude-code`. Or copy the skill folder (ai-specs/skills/owasp-security-audit in LIDR-academy/AI4Devs-LTI-extended) into .claude/skills/owasp-security-audit in your project. Claude Code loads it when a task matches its description.
How do I install Owasp Security Audit in Codex?
Run `npx skills add LIDR-academy/AI4Devs-LTI-extended --skill owasp-security-audit -a codex`. Or copy the skill folder (ai-specs/skills/owasp-security-audit in LIDR-academy/AI4Devs-LTI-extended) into .agents/skills/owasp-security-audit in your project. Codex loads it when a task matches its description.
Can I use Owasp Security Audit in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add LIDR-academy/AI4Devs-LTI-extended --skill owasp-security-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/owasp-security-audit, .gemini/skills/owasp-security-audit, .github/skills/owasp-security-audit and .opencode/skills/owasp-security-audit in your project.
What does Owasp Security Audit need to run?
Going by SKILL.md and its folder, Owasp Security Audit needs the command-line tools its instructions call (rg, npm, curl, git, python3 and npx). Our summary lists: Node.js.
Does Owasp Security Audit access the network?
SKILL.md contains no URLs. Its commands use npm, curl, git and npx, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Owasp Security Audit safe to install?
Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Owasp Security Audit use?
Owasp Security Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Owasp Security Audit use?
About 4.3k tokens (SKILL.md is roughly 17k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Owasp Security Audit?
Skills that share tags, products or a category with Owasp Security Audit: Security Auditor (eigent-ai/eigent, 15k stars), Code Audit (3stoneBrother/code-audit, 892 stars), Security Verification Gate (fengshao1227/ccg-workflow, 5.9k stars) and Security Audit Scanner (ruvnet/ruflo, 74k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Owasp Security Audit?
LIDR-academy (a GitHub organization) maintains it in LIDR-academy/AI4Devs-LTI-extended, which has 278 GitHub stars. The repository holds 9 skills in this directory. The repository was last updated on June 9, 2026.
Source: LIDR-academy/AI4Devs-LTI-extended on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.