# Conduct Structured Security Reviews

Security reviews can miss important controls across applications, infrastructure, and supply chains. This skill provides framework-based checklists and a consistent finding format for focused reviews.

## Install

```bash
npx skillstore add clementwalter/security-audit
```

## Metadata

- Status: approved
- Slug: clementwalter-security-audit
- Skillstore revision: r2
- Version status: missing
- Tree hash: 1ed6595e2c876f3b59adecaaeb1f6e16357d9f1a2b632b0d522f3c0fb96fe009
- Author: ClementWalter
- GitHub username: ClementWalter
- License: MIT
- Repository: https://github.com/ClementWalter/rookie-marketplace/tree/main/security-researcher/skills/security-audit
- Ref: c68df504887c54bf71d2d467a1fbebde49467868
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: filesystem, scripts
- Quality score: 70
- Public page: https://skillstore.pages.dev/skills/clementwalter-security-audit
- Manifest: https://skillstore.pages.dev/api/skills/clementwalter-security-audit/manifest

## Capabilities

- Guides threat modeling with STRIDE categories and trust boundaries.
- Structures findings with severity, impact, recommendation, and references.
- Reviews application controls using OWASP Top 10 and ASVS checklists.
- Assesses dependency, CI/CD, provenance, and release controls.
- Provides focused review checklists for cryptography, smart contracts, and ZK circuits.

## Use Cases

- Review an application pull request: Identify authorization, input handling, session, and logging controls that need review.
- Assess delivery pipeline controls: Review dependencies, CI permissions, artifact integrity, and release provenance.
- Prepare a protocol security review: Check contract invariants, key custody, ZK constraints, and proof verification assumptions.

## Prompt Templates

### Start a web application review

```
Review this web application component using the OWASP checklist. List the highest-priority questions and missing evidence.
```

### Model a service threat

```
Create a STRIDE threat model for this service. Identify trust boundaries, assets, threats, and recommended controls.
```

### Assess supply chain controls

```
Review this repository delivery process against SLSA and OpenSSF guidance. Prioritize gaps in dependencies, CI/CD, and releases.
```

### Review a ZK circuit design

```
Review this ZK circuit design for constraint soundness, range checks, transcript binding, and verifier assumptions. Return findings in the specified format.
```

## Limitations

- Does not execute security scanners or validate a running system.
- Does not replace a qualified penetration test or independent audit.
- Requires accurate system context and source material from the user.
- Provides guidance and findings, not compliance certification.

## Best Practices

- Define scope, assets, trust boundaries, and authorization before beginning a review.
- Prioritize findings by realistic impact, exploitability, and available evidence.
- Record assumptions and validate recommendations with the owning team.

## Anti Patterns

- Do not treat checklist completion as proof that a system is secure.
- Do not report findings without a clear location, impact, and remediation path.
- Do not test systems without explicit authorization and an agreed scope.

## Security Audit

- Audited at: 2026-07-18T10:48:12.753\+00:00
- Summary: Manual review found a documentation-only security-review skill with no executable code, network actions, filesystem actions, or prompt-injection content. All 14 static detections are false positives caused by defensive checklist language or the missing frontmatter scan limitation. The skill provides security guidance only and should be applied to authorized systems.

## Stats

- Views: 216
- Downloads: 11
- Favorites: 0
- Popularity score: 0