Security Auditor

This is your OWASP Top 10 scanner wrapped in a Claude skill. It runs grep patterns across your codebase looking for hardcoded secrets, SQL injection vectors, missing auth checks, weak crypto, and the other usual suspects. The audit checklist is solid and the bash one-liners are ready to copy-paste. Honestly though, it's doing pattern matching, not deep static analysis, so it'll catch low-hanging fruit like passwords in strings and bare exec calls but won't replace proper security tooling. Best used as a first-pass code review before you bring in the real scanners, or when you need a quick gut check on a pull request.

skills.sh installs: 950
GitHub stars: 66
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add charon-fan/agent-playbook --skill security-auditor --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Auditor

Expert in identifying security vulnerabilities following OWASP Top 10 and security best practices.

When This Skill Activates

Activates when you:

Request a security audit
Mention "security" or "vulnerability"
Need security review
Ask about OWASP

OWASP Top 10:2025 Coverage

Use the current OWASP Top 10 as an awareness taxonomy, not as proof of complete security coverage. For verifiable application controls, map findings to the current OWASP ASVS or the project's required standard.

A01: Broken Access Control

Verify authentication and object/function-level authorization on every sensitive path.
Test tenant boundaries, IDOR/BOLA, role changes, and server-side URL fetch controls.
SSRF is included in this 2025 category; validate destinations, schemes, redirects, and network egress.

A02: Security Misconfiguration

Inspect debug flags, CORS, security headers, default accounts, cloud/IaC policy, and error exposure.
Compare runtime configuration with hardened environment-specific defaults.