# Audit Application Security Before Deployment

Production reviews can miss command injection, excessive permissions, exposed secrets, and unsafe input handling. This skill provides a structured, read-only audit across backend and frontend controls.

## Install

```bash
npx skillstore add applelamps/security-audit
```

## Metadata

- Status: approved
- Slug: applelamps-security-audit
- Skillstore revision: r2
- Version status: missing
- Tree hash: 3c2ebb7485ecbbd34976f8c4b5e33e463e65493f78cff37315aa4807e662ea02
- Author: AppleLamps
- GitHub username: AppleLamps
- License: MIT
- Repository: https://github.com/AppleLamps/web-term/tree/main/.claude/skills/security-audit
- Ref: 89edfdc710d0846129dcee6a929477b04f08052c
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, env\_access
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/applelamps-security-audit
- Manifest: https://skillstore.pages.dev/api/skills/applelamps-security-audit/manifest

## Capabilities

- Reviews command execution for shell injection, dangerous patterns, and a 15-second timeout.
- Checks Chat and Agent mode tool permissions for excessive access or bypass risks.
- Reviews environment file handling, hardcoded API keys, and python-dotenv usage.
- Checks WebSocket authentication, message validation, and user input injection risks.
- Reviews markdown rendering, image upload handling, and sensitive client-side data.
- Organizes results into critical issues, warnings, and recommendations.

## Use Cases

- Predeployment Review: Assess command execution, secrets, permissions, WebSockets, and frontend controls before a production release.
- Backend Risk Assessment: Review terminal command handling, timeouts, tool restrictions, authentication, and input validation.
- Security Triage: Create an urgency-based report that separates immediate issues, warnings, and recommended improvements.

## Prompt Templates

### Basic Security Audit

```
Run a read-only security audit of this repository and group findings into critical issues, warnings, and recommendations.
```

### Command and Permission Review

```
Review command execution and tool permissions. Check shell injection, dangerous commands, timeout enforcement, allowed tools, and permission bypass risks.
```

### Secrets and WebSocket Review

```
Audit secrets management and WebSocket security. Check ignored environment files, hardcoded keys, authentication, message validation, and user input injection.
```

### Full Production Readiness Audit

```
Perform the complete read-only audit. Cite evidence, explain impact, prioritize remediation, and include command, permission, secret, WebSocket, and frontend risks.
```

## Limitations

- The audit is read-only and does not modify vulnerable files.
- The checklist assumes the repository contains the named backend, modes, and WebSocket endpoint.
- It does not run automated scanners, tests, or vulnerability exploits.
- Findings depend on the source files available during review and require developer verification.

## Best Practices

- Provide the complete relevant repository so findings can cite implementation evidence.
- Run the audit after changes to commands, permissions, authentication, uploads, or secret handling.
- Verify each reported issue and prioritize fixes by impact before deployment.

## Anti Patterns

- Do not treat checklist coverage as proof that the application is secure.
- Do not expose discovered API keys or environment values in the report.
- Do not exploit a suspected vulnerability while gathering evidence.

## Security Audit

- Audited at: 2026-07-23T05:19:58.31\+00:00
- Summary: All eight static findings are false positives caused by Markdown code spans describing audit checks; none executes commands or accesses secrets. SKILL.md defines a read-only review workflow and contains no prompt injection or other semantic security issue.

## Stats

- Views: 215
- Downloads: 12
- Favorites: 0
- Popularity score: 0