{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/security-audit",
  "version": "1.0.0",
  "name": "Security Audit",
  "description": "Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.",
  "system_prompt_fragment": "# Security Auditing Workflow Bundle\n\n## Overview\n\nComprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation.\n\n## When to Use This Workflow\n\nUse this workflow when:\n- Performing security audits on web applications\n- Testing API security\n- Conducting penetration tests\n- Scanning for vulnerabilities\n- Hardening application security\n- Compliance security assessments\n\n## Workflow Phases\n\n### Phase 1: Reconnaissance\n\n#### Skills to Invoke\n- `scanning-tools` - Security scanning\n- `shodan-reconnaissance` - Shodan searches\n- `top-web-vulnerabilities` - OWASP Top 10\n\n#### Actions\n1. Identify target scope\n2. Gather intelligence\n3. Map attack surface\n4. Identify technologies\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @scanning-tools to perform initial reconnaissance\n```\n\n```\nUse @shodan-reconnaissance to find exposed services\n```\n\n### Phase 2: Vulnerability Scanning\n\n#### Skills to Invoke\n- `vulnerability-scanner` - Vulnerability analysis\n- `security-scanning-security-sast` - Static analysis\n- `security-scanning-security-dependencies` - Dependency scanning\n\n#### Actions\n1. Run automated scanners\n2. Perform static analysis\n3. Scan dependencies\n4. Identify misconfigurations\n5. Document vulnerabilities\n\n#### Copy-Paste Prompts\n```\nUse @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities\n```\n\n```\nUse @security-scanning-security-dependencies to audit dependencies\n```\n\n### Phase 3: Web Application Testing\n\n#### Skills to Invoke\n- `top-web-vulnerabilities` - OWASP vulnerabilities\n- `sql-injection-testing` - SQL injection\n- `xss-html-injection` - XSS testing\n- `broken-authentication` - Authentication testing\n- `idor-testing` - IDOR testing\n- `file-path-traversal` - Path traversal\n- `burp-suite-testing` - Burp Suite testing\n\n#### Actions\n1. Test for injection flaws\n2. Test authentication mechanisms\n3. Test session management\n4. Test access controls\n5. Test input validation\n6. Test security headers\n\n#### Copy-Paste Prompts\n```\nUse @sql-injection-testing to test for SQL injection vulnerabilities\n```\n\n```\nUse @xss-html-injection to test for cross-site scripting\n```\n\n```\nUse @broken-authentication to test authentication security\n```\n\n### Phase 4: API Security Testing\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - API fuzzing\n- `api-security-best-practices` - API security\n\n#### Actions\n1. Enumerate API endpoints\n2. Test authentication/authorization\n3. Test rate limiting\n4. Test input validation\n5. Test error handling\n6. Document API vulnerabilities\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to fuzz API endpoints\n```\n\n### Phase 5: Penetration Testing\n\n#### Skills to Invoke\n- `pentest-commands` - Penetration testing commands\n- `pentest-checklist` - Pentest planning\n- `ethical-hacking-methodology` - Ethical hacking\n- `metasploit-framework` - Metasploit\n\n#### Actions\n1. Plan penetration test\n2. Execute attack scenarios\n3. Exploit vulnerabilities\n4. Document proof of concept\n5. Assess impact\n\n#### Copy-Paste Prompts\n```\nUse @pentest-checklist to plan penetration test\n```\n\n```\nUse @pentest-commands to execute penetration testing\n```\n\n### Phase 6: Security Hardening\n\n#### Skills to Invoke\n- `security-scanning-security-hardening` - Security hardening\n- `auth-implementation-patterns` - Authentication\n- `api-security-best-practices` - API security\n\n#### Actions\n1. Implement security controls\n2. Configure security headers\n3. Set up authentication\n4. Implement authorization\n5. Configure logging\n6. Apply patches\n\n#### Copy-Paste Prompts\n```\nUse @security-scanning-security-hardening to harden application security\n```\n\n### Phase 7: Reporting\n\n#### Skills to Invoke\n- `reporting-standards` - Security reporting\n\n#### Actions\n1. Document findings\n2. Assess risk levels\n3. Provide remediation steps\n4. Create executive summary\n5. Generate technical report\n\n## Security Testing Checklist\n\n### OWASP Top 10\n- [ ] Injection (SQL, NoSQL, OS, LDAP)\n- [ ] Broken Authentication\n- [ ] Sensitive Data Exposure\n- [ ] XML External Entities (XXE)\n- [ ] Broken Access Control\n- [ ] Security Misconfiguration\n- [ ] Cross-Site Scripting (XSS)\n- [ ] Insecure Deserialization\n- [ ] Using Components with Known Vulnerabilities\n- [ ] Insufficient Logging & Monitoring\n\n### API Security\n- [ ] Authentication mechanisms\n- [ ] Authorization checks\n- [ ] Rate limiting\n- [ ] Input validation\n- [ ] Error handling\n- [ ] Security headers\n\n## Quality Gates\n\n- [ ] All planned tests executed\n- [ ] Vulnerabilities documented\n- [ ] Proof of concepts captured\n- [ ] Risk assessments completed\n- [ ] Remediation steps provided\n- [ ] Report generated\n\n## Related Workflow Bundles\n\n- `development` - Secure development practices\n- `wordpress` - WordPress security\n- `cloud-devops` - Cloud security\n- `testing-qa` - Security testing",
  "applicable_domains": [
    "security"
  ],
  "category": "security",
  "invocation": [
    "/security-audit"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/security-audit",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/security-audit",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "security",
    "risk-reviewed"
  ],
  "lifecycle": "draft"
}