security-auditor
Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on file changes. Scans for SQL injection, XSS, secrets exposure, auth issues. Triggers on file changes, security mentions, deployment prep.
Security Assessment
Detected risks:
About security-auditor
The security-auditor skill provides continuous security vulnerability scanning to detect common security issues in code, with a particular focus on OWASP Top 10 vulnerabilities. This tool helps developers and teams automatically identify risks such as SQL injection, XSS, authentication weaknesses, and sensitive data exposure. It serves as a proactive defense mechanism by scanning code during the development cycle, such as before deployments, on file changes, and when vulnerabilities are mentioned in discussions. By automating these checks, it reduces the risk of security flaws making their way into production code.
FAQ
When should I use the security-auditor skill?
You should use the security-auditor skill whenever code files are modified, especially related to authentication, APIs, or databases. It is also useful before deployments, commits, or when security-related changes are made in dependencies or configuration files.
What vulnerabilities does the security-auditor skill detect?
The security-auditor skill detects a variety of vulnerabilities, including SQL injection, XSS, authentication issues, sensitive data exposure, broken access control, insecure deserialization, and misconfigurations like CSRF and CORS issues.
What are the requirements for using the security-auditor skill?
The security-auditor skill requires access to tools like Read, Grep, and Bash. It also depends on your ability to review the alerts it provides and integrate it into your existing code review or deployment pipelines.
Does the security-auditor skill integrate with other tools or services?
The security-auditor skill works in conjunction with the @code-reviewer sub-agent for enhanced code review workflows and can also integrate with dependency scanning tools like npm audit (for Node.js) and pip-audit (for Python).
Install security-auditor
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
alirezarezvani/claude-code-tresor