Skip to content
cccskills
FreePublished on GitHub

security-audit

Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates to the Centinela (QA) agent.

The English summary is being prepared. Showing the original description.

See how to install

Files included (1)

  • SKILL.md1.7 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Security Audit

Performs a deep security audit using the Centinela (QA) agent.

When to Use This Skill

  • Before a release to verify security posture
  • After significant code changes that touch authentication, authorization, or data handling
  • Periodic security review of the codebase
  • When adding new dependencies or external integrations

What This Skill Does

  1. Runs the SIGN IN checklist
  2. Performs OWASP Top 10 systematic check (A01-A10)
  3. Scans for hardcoded secrets, API keys, tokens, and connection strings
  4. Audits dependencies for known CVEs
  5. Checks smart contracts if Solidity is present (reentrancy, overflow, access control)
  6. Runs Security Verification and Quality Verification checklists (TIME OUT)
  7. Issues verdict and writes report to docs/reviews/security-audit-{date}.md
  8. Prepares findings handoff to Dev agent

How to Use

Basic Usage

/security-audit

Scoped Audit

/security-audit src/auth/ src/api/

Example

User: /security-audit src/payments/

Output: A security audit report at docs/reviews/security-audit-2026-02-23.md with:

  • OWASP Top 10 findings organized by severity
  • Secrets scan results
  • Dependency vulnerability report
  • Verdict: APPROVED or CHANGES REQUIRED
  • Fix order recommendation for the Dev agent

Tips

  • If no scope is specified, the entire src/ directory is audited
  • Critical findings trigger the Non-Normal emergency checklist
  • The agent will never attempt to fix vulnerabilities — only document them

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Automate ActiveCampaign tasks via Rube MCP (Composio): manage contacts, tags, list subscriptions, automation enrollment, and tasks. Always search tools first for current schemas.

The English summary is being prepared. Showing the original description.

davepoon/buildwithclaude3.7KUpdated Oct 19, 2026

Pull the ads a competitor is running right now on Meta (Facebook/Instagram) and Google, then extract the hooks, offers, CTAs and landing pages worth modelling. Use when writing ad copy, planning creative tests, choosing a landing page angle, or when the user asks "what is X advertising", "what ads does X run", "find competitor ad hooks". Reads live Ad Library and Ads Transparency data through the Tracetify MCP; falls back to a manual Ad Library walkthrough when the connector is absent.

The English summary is being prepared. Showing the original description.

davepoon/buildwithclaude3.7KUpdated Oct 19, 2026

Analytics your AI agent can actually use. Track, analyze, run A/B experiments, and optimize across all your projects via CLI. Includes a growth playbook so your agent knows HOW to grow, not just what to track.

The English summary is being prepared. Showing the original description.

davepoon/buildwithclaude3.7KUpdated Oct 19, 2026

Teaches when to recall from long-term memory before acting and when to save durable decisions, corrections and failures afterwards. Use when a memory tool or MCP memory server is connected but the agent is not using it consistently, when the user complains that the assistant forgets preferences, conventions or past decisions between sessions, or when setting up persistent memory for a project. Works with any memory backend: a folder of Markdown files, a local MCP server, or a managed service.

The English summary is being prepared. Showing the original description.

davepoon/buildwithclaude3.7KUpdated Oct 19, 2026

Audit local AI coding-agent sessions with agenttrace for cost, tokens, tool failures, latency, anomalies, health, diffs, and CI gates.

The English summary is being prepared. Showing the original description.

davepoon/buildwithclaude3.7KUpdated Oct 19, 2026

Checks which private files (.env, keys, secrets) Claude Code and its subagents reached in this project, whether a value came into an agent's context, and which key to change, by running the open source agentwhy CLI over the session records Claude Code already keeps on disk. Use when the user asks whether the agent or a subagent read their .env or other secrets, which private files a session touched, whether a key leaked into the conversation, or which key to rotate. Runs locally and never prints a secret value.

The English summary is being prepared. Showing the original description.

davepoon/buildwithclaude3.7KUpdated Oct 19, 2026

See all skills by davepoon

Report a problem with this skill