security-audit – Security skill for AI agents

Security Auditing Workflow Bundle

> ⚠️ AUTHORIZED USE ONLY

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate

Before each active security action, state the exact target URL, IP, account, or resource, the written-authorization confirmation, permitted scope, exact command, expected effect and limits. Without confirmation, remain read-only and provide defensive guidance only. Wait for explicit confirmation in the current conversation before executing it. Existing scope does not authorize expanding targets or techniques.

Overview

Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation.

When to Use This Workflow

Use this workflow when:

• Performing security audits on web applications
• Testing API security
• Conducting penetration tests
• Scanning for vulnerabilities
• Hardening application security
• Compliance security assessments

Before active testing, obtain written authorization naming exact targets, accounts, techniques, time window, request/concurrency/byte limits, prohibited actions and stop conditions. Select approved phases rather than launching every referenced skill. Use owned test fixtures for injections, exploitation and account actions; never extract real customer data or persist access to prove impact. Static source/dependency review may proceed within authorized read scope. Separate suspected scanner signals from reproduced findings, preserve redacted evidence and record untested scope.

Workflow Phases

Phase 1: Reconnaissance

Skills to Invoke

• scanning-tools - Security scanning
• shodan-reconnaissance - Shodan searches
• top-web-vulnerabilities - OWASP Top 10

Actions

1. Identify target scope

2. Gather intelligence

3. Map attack surface

4. Identify technologies

5. Document findings

Copy-Paste Prompts

Use @scanning-tools to perform initial reconnaissance

Use @shodan-reconnaissance to find exposed services

Phase 2: Vulnerability Scanning

Skills to Invoke

• vulnerability-scanner - Vulnerability analysis
• security-scanning-security-sast - Static analysis
• security-scanning-security-dependencies - Dependency scanning

Actions

1. Run automated scanners

2. Perform static analysis

3. Scan dependencies

4. Identify misconfigurations

5. Document vulnerabilities

Copy-Paste Prompts

Use @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities

Use @security-scanning-security-dependencies to audit dependencies

Phase 3: Web Application Testing

Skills to Invoke

• top-web-vulnerabilities - OWASP vulnerabilities
• sql-injection-testing - SQL injection
• xss-html-injection - XSS testing
• broken-authentication - Authentication testing
• idor-testing - IDOR testing
• file-path-traversal - Path traversal
• burp-suite-testing - Burp Suite testing

Actions

1. Test for injection flaws

2. Test authentication mechanisms

3. Test session management

4. Test access controls

5. Test input validation

6. Test security headers

Copy-Paste Prompts

Use @sql-injection-testing to test for SQL injection vulnerabilities

Use @xss-html-injection to test for cross-site scripting

Use @broken-authentication to test authentication security

Phase 4: API Security Testing

Skills to Invoke

• api-fuzzing-bug-bounty - API fuzzing
• api-security-best-practices - API security

Actions

1. Enumerate API endpoints

2. Test authentication/authorization

3. Test rate limiting

4. Test input validation

5. Test error handling

6. Document API vulnerabilities

Copy-Paste Prompts

Use @api-fuzzing-bug-bounty to fuzz API endpoints

Phase 5: Penetration Testing

Skills to Invoke

• pentest-commands - Penetration testing commands
• pentest-checklist - Pentest planning
• ethical-hacking-methodology - Ethical hacking
• metasploit-framework - Metasploit

Actions

1. Plan penetration test

2. Execute attack scenarios

3. Exploit vulnerabilities

4. Document proof of concept

5. Assess impact

Copy-Paste Prompts

Use @pentest-checklist to plan penetration test

Use @pentest-commands to execute penetration testing

Phase 6: Security Hardening

Skills to Invoke

• security-scanning-security-hardening - Security hardening
• auth-implementation-patterns - Authentication
• api-security-best-practices - API security

Actions

1. Implement security controls

2. Configure security headers

3. Set up authentication

4. Implement authorization

5. Configure logging

6. Apply patches

Copy-Paste Prompts

Use @security-scanning-security-hardening to harden application security

Phase 7: Reporting

Skills to Invoke

• reporting-standards - Security reporting

Actions

1. Document findings

2. Assess risk levels

3. Provide remediation steps

4. Create executive summary

5. Generate technical report

Security Testing Checklist

Vulnerability coverage (historical OWASP-style checklist)

• [ ] Injection (SQL, NoSQL, OS, LDAP)
• [ ] Broken Authentication
• [ ] Sensitive Data Exposure
• [ ] XML External Entities (XXE)
• [ ] Broken Access Control
• [ ] Security Misconfiguration
• [ ] Cross-Site Scripting (XSS)
• [ ] Insecure Deserialization
• [ ] Using Components with Known Vulnerabilities
• [ ] Insufficient Logging & Monitoring

API Security

• [ ] Authentication mechanisms
• [ ] Authorization checks
• [ ] Rate limiting
• [ ] Input validation
• [ ] Error handling
• [ ] Security headers

Quality Gates

• [ ] All planned tests executed
• [ ] Vulnerabilities documented
• [ ] Proof of concepts captured
• [ ] Risk assessments completed
• [ ] Remediation steps provided
• [ ] Report generated

Related Workflow Bundles

• development - Secure development practices
• wordpress - WordPress security
• cloud-devops - Cloud security
• testing-qa - Security testing

Limitations

• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.