Security Audit Skill
A portable security auditing skill that teaches AI coding assistants to become expert security auditors. Works with Claude Code, Codex CLI, Cursor, and any AI that can learn from prompts.
What is This?
This is not a tool you install and run. It's a skill - a set of instructions and patterns that teach an AI assistant how to perform comprehensive security audits on any codebase.
Think of it like giving your AI assistant a security certification.
Why a Skill Instead of a Tool?
| Traditional Tool | AI Skill |
|---|---|
| Runs regex patterns mechanically | Understands context and intent |
| Fixed rules, many false positives | Can reason about actual risk |
| Only finds exact pattern matches | Can identify novel vulnerabilities |
| Reports everything, you filter | Prioritizes what matters |
| Just flags issues | Explains why and how to fix |
An AI with security knowledge can:
- Follow data flow across functions and files
- Understand your specific architecture
- Explain attack scenarios in context
- Suggest fixes that match your codebase style
- Answer follow-up questions
Quick Start
Claude Code
Copy the skill file to your project or global config:
# Per-project (recommended)
mkdir -p .claude/skills
cp skills/security-audit.md .claude/skills/
# Or install globally
mkdir -p ~/.claude/skills
cp skills/security-audit.md ~/.claude/skills/
Then ask Claude Code to audit your code:
"Audit this codebase for security vulnerabilities"
"Check src/api for injection risks"
"Is this authentication implementation secure?"
Codex CLI
Add the skill to your Codex instructions:
# Add to your AGENTS.md or instructions file
cat skills/security-audit.md >> AGENTS.md
Or reference it in your Codex config:
{
"instructions": "When asked about security, follow the methodology in skills/security-audit.md"
}
Cursor / Other AI Editors
Add to your rules or system prompt:
- Open settings/rules
- Add the contents of
skills/security-audit.md - Or reference it: "For security audits, use the methodology in skills/security-audit.md"
Any AI Chat
Simply paste the skill content before your question:
[paste skills/security-audit.md]
Now audit this code for security issues:
[paste your code]
What Gets Detected
Critical (Fix Immediately)
- SQL Injection - Concatenated queries, f-strings in execute()
- Command Injection - exec() with user input, shell=True
Medium Priority
- XSS - innerHTML, dangerouslySetInnerHTML, document.write
- SSRF - User-controlled URLs in fetch/axios/requests
- Path Traversal - User input in file operations
- NoSQL Injection - Variable objects in MongoDB queries
Low Priority
- Template Injection - Variable templates
- Debug Code - alert(), console.log with sensitive data
Beyond Pattern Matching
The AI can also review:
- Authentication & session handling
- Authorization & access controls
- Cryptography usage
- Dependency vulnerabilities
- Security headers & configuration
- Secrets management
- Error handling
Files
skills/
├── security-audit.md # Main skill - comprehensive methodology
└── vulnerability-patterns.md # Quick reference - patterns & regex
security-audit.md
The complete skill teaching:
- Systematic audit methodology
- Taint analysis (tracking untrusted data)
- Vulnerability patterns with examples
- Language-specific guidance (JS/TS, Python, React)
- Fix recommendations
- Output format
vulnerability-patterns.md
Quick reference containing:
- All detection patterns in table format
- Regex patterns for grep/ripgrep
- Severity classifications
- Taint source patterns
Example Session
You: Audit this Express route for security issues
AI: I'll analyze this route using systematic security methodology...
## Security Audit: user-routes.js
### Critical Issues (1)
#### SQL Injection at line 24
**Code:**
```javascript
db.query(`SELECT * FROM users WHERE id = ${req.params.id}`)
Risk: Attacker can inject SQL via the id parameter to extract or modify database contents. Fix:
db.query('SELECT * FROM users WHERE id = ?', [req.params.id])
Medium Issues (2)
Path Traversal at line 31
...
Recommendations
- Use parameterized queries throughout
- Add input validation middleware
- Consider using an ORM like Prisma
## Extending the Skill
### Add Custom Patterns
Edit `skills/vulnerability-patterns.md` to add patterns specific to your stack:
```markdown
### Custom: Unsafe Deserialization
| ID | Language | Pattern | Description |
|----|----------|---------|-------------|
| CUSTOM001 | Python | `pickle\.loads?\s*\(` | Pickle deserialization |
Add Framework-Specific Rules
Extend skills/security-audit.md with your framework's security considerations:
## Next.js Specific
### Server Actions
- Validate all inputs in server actions
- Don't expose sensitive data in client components
- Use `headers()` and `cookies()` safely
Philosophy
Zero network calls - Everything runs locally in your AI's context
Teach, don't just flag - The AI explains vulnerabilities, not just lists them
Context-aware - The AI understands your code, not just pattern matches
Portable - Works with any AI that can read markdown
Extensible - Add your own patterns and rules
Contributing
Add patterns, improve explanations, support more languages:
- Fork this repo
- Edit files in
skills/ - Submit a PR
License
MIT - Use freely, contribute back if you can.