Security-focused code audit for healthcare and military contexts. Use when reviewing authentication, authorization, data handling, HIPAA compliance, or OPSEC/PERSEC requirements. Essential for PHI handling and military medical residency schedules.
Detected risks:
The security-audit skill provides specialized auditing for software systems that handle sensitive healthcare and military data, with a particular focus on Protected Health Information (PHI) and operational or personnel security (OPSEC/PERSEC) requirements. It is designed to identify vulnerabilities in authentication, authorization, data handling, and API security, ensuring compliance with strict regulatory and security standards such as HIPAA. By systematically evaluating code for potential breaches, misconfigurations, and data exposure risks, this skill helps prevent unauthorized access, data leaks, and operational compromises in environments that demand the highest security standards.
Key features of this skill include comprehensive checks for HIPAA compliance, military-specific OPSEC/PERSEC protections, and adherence to the OWASP Top 10 security risks. It evaluates role-based access control, audit logging, encryption in transit and at rest, and ensures minimal data exposure. The skill supports code review for cryptographic operations, third-party integrations, API endpoint security, and file handling, offering a structured audit process that includes threat modeling, authentication review, and input validation. Additionally, it provides guidelines for safely using synthetic identifiers in demos and testing environments to prevent accidental disclosure of sensitive information.
This skill is particularly valuable for healthcare IT developers, security engineers, and teams managing military medical residency schedules or other sensitive personnel data. It is used during code changes involving authentication, PHI handling, or critical system integrations, as well as for pre-deployment security assessments. Organizations aiming to meet regulatory compliance and maintain operational security while developing or maintaining healthcare and military applications will benefit most from integrating this skill into their auditing and development workflows.
Use this skill when reviewing code changes related to authentication, authorization, PHI handling, API security, file uploads/downloads, cryptographic operations, or military personnel data. It's especially important for pre-deployment security checks and compliance verification.
The skill is designed for Python-based systems, particularly those using FastAPI and Pydantic for request validation and database operations with async sessions.
Yes, it can run in parallel with code-review, test-writer, and lint-monorepo tasks, although batch size is optimized for three concurrent audits.
The skill focuses on security for healthcare and military contexts. It does not generate fixes or code but provides auditing guidance. It does not cover non-security functionality or unrelated application domains.
It uses synthetic identifiers for residents and faculty to prevent exposure of real names or schedules in demo and test environments.
Quick Setup:
.claude/skills/