audit-security

The audit-security skill is a specialized AI tool designed to identify and address security vulnerabilities in code. It operates either as a standalone tool or in the background during implementation, providing continuous monitoring for critical security risks. By detecting issues such as hardcoded credentials, SQL injection, XSS vulnerabilities, command injection, and improper authentication or authorization, it helps developers maintain secure codebases and reduce potential attack surfaces. The skill is capable of generating detailed findings and injecting critical issues directly into the main agent, ensuring immediate attention to high-priority security threats.

Key features of the audit-security skill include comprehensive checks across multiple severity levels, categorized as P0 (critical), P1 (important), and P2 (minor). It supports background execution during implementation, outputting results to designated directories such as `.claude/output` or `.codex/output`, and integrates with the main agent to communicate urgent findings. The skill also includes language-specific checks, such as Flutter/Dart security considerations, highlighting issues like insecure data storage, missing input validation, and logging sensitive data. Its execution flow ensures systematic scanning of files, prioritization of critical vulnerabilities, and organized reporting for remediation.

This skill is particularly useful for developers, security engineers, and QA teams who need to maintain secure code during development cycles. Use cases include performing pre-merge security reviews, running continuous background audits during implementation, and ensuring compliance with security best practices. It is ideal for projects where data sensitivity is high, authentication and authorization are critical, and proactive identification of vulnerabilities can prevent costly breaches or system compromises.