auditing-security

Q: How do I install auditing-security?

Run npx skills add https://github.com/spencerpauly/awesome-cursor-skills --skill auditing-security in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/auditing-security/ (personal) or .claude/skills/auditing-security/ (project).

by spencerpaulySecurity

Perform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns.

Installs: 598
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/spencerpauly/awesome-cursor-skills --skill auditing-security

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads auditing-security automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Security Audit

Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

Steps

Scan for hardcoded secrets — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like:
- password=, secret=, token=, api_key=
- Base64-encoded credentials
- AWS keys (AKIA...), Stripe keys (sk_live_...), GitHub tokens (ghp_...)
- Files: .env committed to git, config.json with credentials
Check authentication & authorization
- Verify all API routes check authentication before processing.
- Ensure role-based access control is enforced server-side, not just in the UI.
- Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).
- Verify session tokens are HTTP-only, secure, and have reasonable expiry.
Check for injection vulnerabilities
- SQL injection: look for string concatenation in SQL queries instead of parameterized queries.
- XSS: look for dangerouslySetInnerHTML, innerHTML, or unescaped user input rendered in templates.
- Command injection: look for exec(), eval(), child_process.exec() with user input.
- Path traversal: check file operations for unsanitized user input in paths.
Review dependency security
- Run npm audit or pip audit to check for known vulnerabilities.
- Flag outdated dependencies with known CVEs.
- Check for overly permissive dependency ranges.
Check CORS and CSP configuration
- Verify CORS doesn't use Access-Control-Allow-Origin: * in production.
- Check for Content Security Policy headers.
- Verify X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security headers.
Review data exposure
- Check API responses for leaking sensitive fields (password hashes, internal IDs, PII).
- Verify error messages don't expose stack traces or internal details in production.
- Check logging for sensitive data being written to logs.
Generate report — produce a summary with severity ratings (Critical / High / Medium / Low) for each finding, with the file path, line number, and recommended fix.

Notes

This is a code review, not a penetration test. Recommend tools like npm audit, trivy, or snyk for automated scanning.
Always check .gitignore to ensure .env, credentials, and key files are excluded.
For comprehensive auditing, recommend the OWASP Testing Guide.

FAQ

What does the auditing-security skill do?

Perform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns.

How do I install auditing-security?

Run npx skills add https://github.com/spencerpauly/awesome-cursor-skills --skill auditing-security in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/auditing-security/ (personal) or .claude/skills/auditing-security/ (project).

Which AI agents can use auditing-security?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is auditing-security safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains auditing-security?

It is published by spencerpauly in spencerpauly/awesome-cursor-skills. It has 598 recorded installs.