# Audit Applications for Security Risk

Security reviews can miss common vulnerabilities when scope, severity, and remediation are unclear. This skill guides structured audits using OWASP checks, CVSS scoring, and report templates.

## Install

```bash
npx skillstore add joseph obrien/89jobrien-security-audit
```

## Metadata

- Status: approved
- Slug: 89jobrien-security-audit
- Version: 1.0.1
- Author version: 1.0.1
- Skillstore revision: r1
- Version status: valid
- Tree hash: b6944d6569015ffdbdb29a9680092939d2e05c4de74e6200c82989370cead6ae
- Author: Joseph OBrien
- GitHub username: 89jobrien
- License: MIT
- Repository: https://github.com/89jobrien/steve/tree/main/steve/skills/security-audit
- Ref: c4037264bbd363c572662d6154a3ab28f5ca4f53
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 79
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/89jobrien-security-audit
- Manifest: https://skillstore.pages.dev/api/skills/89jobrien-security-audit/manifest

## Capabilities

- Guides security code reviews for application releases.
- Maps findings to OWASP Top 10 categories.
- Supports CVSS severity scoring and CWE classification.
- Structures reports with executive summaries, scope, findings, and remediation.
- Reviews authentication, authorization, data protection, and dependency risks.

## Use Cases

- Pre-Release Security Review: Engineering teams use the skill to review code, dependencies, and controls before production release.
- OWASP Gap Assessment: Security teams compare an application against OWASP Top 10 categories and document missing controls.
- Remediation Planning: Product and platform leads turn findings into prioritized fixes with severity, impact, and owner-ready recommendations.

## Prompt Templates

### Start a Basic Audit

```
Audit my application for security risks. Scope: [components]. Focus on OWASP Top 10 and summarize the highest risks first.
```

### Review a Pull Request

```
Review this pull request for authentication, authorization, input validation, and secret handling issues. Provide severity, evidence, and remediation steps.
```

### Create a Full Audit Report

```
Create a security audit report for [system] using the provided architecture, code notes, and dependency data. Include CVSS, CWE, OWASP mapping, and a remediation roadmap.
```

### Adjudicate Scanner Results

```
Adjudicate these scanner results against source evidence. Remove false positives, keep uncertain items with confidence, and produce an executive risk summary.
```

## Limitations

- Does not run automated scanners or commands by itself.
- Requires access to relevant code, architecture, and configuration evidence.
- Cannot validate exploitability without safe test environments and user approval.
- Uses reference checklists, so final decisions need professional judgment.

## Best Practices

- Provide scope, architecture, code paths, and deployment context before asking for findings.
- Ask for evidence, severity rationale, and remediation for every confirmed issue.
- Review generated recommendations with the system owner before publishing an audit report.

## Anti Patterns

- Using the skill as a replacement for authorized penetration testing.
- Requesting exploit steps without a controlled and approved test environment.
- Publishing severity ratings without validating business impact and asset exposure.

## Security Audit

- Audited at: 2026-07-05T13:33:22.087\+00:00
- Summary: All three static findings were adjudicated as false positives. The suspected template-injection line is an audit report placeholder, and the two shell-execution findings are Markdown file references. No semantic evidence of prompt injection, exfiltration, or malicious intent was found.

## Stats

- Views: 203
- Downloads: 13
- Favorites: 0
- Popularity score: 0