Skills security-checklist

📦

security-checklist

Name: security-checklist
Author: AI Agent Hub

v1.0.0 Content revision r2 Medium Risk ⚡ Contains scripts🌐 Network access⚙️ External commands📁 Filesystem access🔑 Env variables

Audit Applications with an OWASP Security Checklist

Security reviews can miss common vulnerabilities and inconsistent controls. This skill provides structured OWASP checks, secure examples, and scanning workflows for repeatable assessments.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "security-checklist" from https://skillstore.io/skills/ariegoldkin-security-checklist.md and its manifest at https://skillstore.io/api/skills/ariegoldkin-security-checklist/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/ariegoldkin-security-checklist.md Signed manifest GET /api/skills/ariegoldkin-security-checklist/manifest Signed lockfile GET /api/skills/ariegoldkin-security-checklist/lockfile

Test it

Using "security-checklist". Review a profile endpoint that accepts a user ID.

Expected outcome:

High: Verify resource ownership before returning profile data.
Medium: Use a parameterized query and validate the identifier format.
Evidence needed: route authorization tests for another user's identifier.

Using "security-checklist". Create a security scan plan for a Python service.

Expected outcome:

Run pip-audit for dependencies after approval.
Run Bandit for Python security patterns.
Record tool versions, exit codes, findings, and reviewed false positives.

Using "security-checklist". Assess a server feature that fetches user-provided URLs.

Expected outcome:

High: Enforce a hostname allowlist and block private or metadata ranges.
Disable redirects or validate every redirect target.
Set strict timeouts and isolate the fetch service from internal networks.

Security Audit

Medium Risk

v10 • 7/23/2026 Open versioned report

All 141 static detections are false positives caused by Markdown syntax, defensive checklists, or intentionally vulnerable and remediated examples. No executable payload, prompt injection, credential collection, or exfiltration logic was found. Separate risks remain around automatic scans, unpinned tool installation, and active tests without explicit authorization boundaries.

Files scanned

1,270

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Medium

SKILL.md:73 SKILL.md:550-555 SKILL.md:824-832

Automatic Local Scan Execution Without Confirmation

The skill says it automatically detects tools and auto-triggers broad scans. These commands can inspect repositories, contact registries, and write report files without explicit approval.

The source directly states that the skill automatically uses detected tools and auto-triggers scans. Multiple operational command examples confirm the intended behavior.

Medium

SKILL.md:36-51 SKILL.md:868-893

Unpinned Security Tool Installation

Installation guidance uses unpinned packages and mutable latest versions. A changed or compromised upstream release could execute with the agent's local privileges.

The listed pip, Go, Docker, and Homebrew installation commands omit immutable versions or digests. The Go command explicitly selects the latest release.

Medium

checklists/owasp-top-10-checklist.md:20-25 checklists/owasp-top-10-checklist.md:71-75 checklists/owasp-top-10-checklist.md:241-245

Active Security Tests Lack Authorization Boundaries

The checklist recommends privilege, injection, internal-network, and metadata tests without requiring authorization or a controlled environment. Misuse could access protected data or services.

The source contains active test instructions, including cloud metadata and other-user access tests. No authorization, scope, or staging prerequisite appears in the audited files.

Risk Factors

⚡ Contains scripts (3)

checklists/owasp-top-10-checklist.md:256 SKILL.md:197 SKILL.md:197

🌐 Network access (9)

checklists/owasp-top-10-checklist.md:244 SKILL.md:388 SKILL.md:399 SKILL.md:853 SKILL.md:390 SKILL.md:406 SKILL.md:329 SKILL.md:444 SKILL.md:414

⚙️ External commands (50)

📁 Filesystem access (1)

SKILL.md:721

🔑 Env variables (4)

SKILL.md:233 SKILL.md:233 SKILL.md:471 SKILL.md:476

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/ariegoldkin-security-checklist/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/ariegoldkin-security-checklist/security.svg)](https://skillstore.io/skills/ariegoldkin-security-checklist?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/ariegoldkin-security-checklist?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ariegoldkin-security-checklist/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/ariegoldkin-security-checklist.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AI Agent Hub. (2026). security-checklist security audit report (audit version 10) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/ariegoldkin-security-checklist/audits/10

BibTeX citation

@techreport{ai-agent-hub-ariegoldkin-security-checklist-2026,
  author = {AI Agent Hub},
  title = {security-checklist security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/ariegoldkin-security-checklist/audits/10},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-checklist security audit report (audit version 10)"
version: "1.0.0"
type: report
authors:
  - name: "AI Agent Hub"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/ariegoldkin-security-checklist/audits/10"
identifiers:
  - type: other
    value: "skillstore:ariegoldkin-security-checklist:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review a New Feature

Check access control, validation, data handling, and error behavior before merging a feature.

Standardize Security Reviews

Apply consistent OWASP evidence and remediation criteria across repository reviews.

Add Pipeline Scanning

Select dependency, static analysis, secret, and container scans for delivery pipelines.

Try These Prompts

Run a Basic Checklist Review

Review this feature against the quick-start checklist. List missing controls, evidence, severity, and practical fixes. Ask for any context you need.

Assess Authentication Security

Assess this authentication flow for OWASP risks. Check password storage, sessions, MFA, rate limits, account enumeration, and authorization. Prioritize findings.

Plan Repository Scanning

Create a security scan plan for this repository. Select relevant dependency, SAST, secret, and container tools. Do not install or run tools without approval.

Perform a Threat-Focused Review

Review this architecture and supplied code. Map findings to OWASP categories, cite evidence, challenge assumptions, and propose verified remediations.

Best Practices

Provide architecture, framework, data classification, and trust boundaries before review.
Confirm permission before running tools, and use the least privileges required.
Validate automated findings manually and record reproducible evidence for each decision.

Avoid

Do not run active payloads against unauthorized or production systems.
Do not install unpinned tools or apply automated fixes without review.
Do not treat checklist completion as proof that a system is secure.

Frequently Asked Questions

What does this skill review?

It covers OWASP risks, authentication, authorization, validation, headers, logging, secrets, dependencies, and selected compliance controls.

Does it run security tools automatically?

The source includes automatic scan workflows. Review each command and grant explicit approval before execution.

Which languages does it support?

Examples focus on Python, JavaScript, TypeScript, SQL, shell workflows, and language-independent security design.

Does it provide compliance certification?

No. It summarizes selected GDPR and SOC 2 considerations but does not replace legal advice or an independent audit.

Can it replace a penetration test?

No. It supports review and planning but cannot replace an authorized assessment by qualified security professionals.

How should false positives be handled?

Verify each result against code and runtime context. Record the evidence and rationale before accepting or dismissing it.

Developer Details

Author

AI Agent Hub

License

MIT

Author version

v1.0.0

Skillstore revision

Repository

https://github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/security-checklist

Ref

89edfdc710d0846129dcee6a929477b04f08052c

Maintenance freshness

7/24/2026

Usage

6 downloads · 211 views

File structure

📁 checklists/

📄 owasp-top-10-checklist.md

📄 SKILL.md