security-audit

Files (4)

• SKILL.md
• auth-review.md · checklists/
• pre-deploy.md · checklists/
• quick-secrets.md · checklists/

SKILL.md (first lines)

# Security Audit Skill

## Purpose

Run a multi-level security audit on the codebase. Each level has a dedicated checklist with specific checks.

## Trigger

User asks to audit security, check for secrets, review authentication, or validate before deployment.

## Levels

| Level | Focus | Duration | Checklist |
|-------|-------|----------|-----------|
| quick-secrets | Exposed API keys, tokens, passwords | ~2 min | `checklists/quick-secrets.md` |
| pre-deploy | Everything in quick-secrets + dependencies, env vars, CORS | ~10 min | `checklists/pre-deploy.md` |
| auth-review | Authentication and authorization patterns | ~15 min | `checklists/auth-review.md` |
| full-audit | Comprehensive security review | ~30 min | `checklists/full-audit.md` |

## Workflow

1. **Present levels**
   - Show the table above to the user
   - Ask which level via AskUserQuestion

2. **Read checklist**
   - Read the corresponding checklist from `.claude/skills/security-audit/checklists/[level].md`

3. **Execute checks**
   - Follow the checklist items in order
   - For each check, use Grep, Glob, Read, or Bash as appropriate
   - Record findings: PASS, FAIL, or N/A

4. **Report**
   - Summarize findings by severity (critical, warning, info)
   - For each FAIL, include the file path and remediation suggestion
   - Overall verdict: CLEAR / ISSUES FOUND

## Report

```
## Security Audit — [Level]

Checklist: [level].md
Files scanned: [N]
Duration: [time]

### Critical
- [finding] (file:line)

### Warnings
- [finding] (file:line)

### Info
- [finding]

### Verdict
CLEAR / ISSUES FOUND — [N] critical, [N] warnings
```

From gilles-bertrand/claudy-plugin, MIT.

More from gilles-bertrand/claudy-plugin