# Audit Code for Common Security Vulnerabilities

Security flaws can hide in queries, shell calls, file paths, exception handlers, and rendered output. This skill guides focused reviews and practical remediation across Python and TypeScript.

## Install

```bash
npx skillstore add consiliency/security-audit
```

## Metadata

- Status: approved
- Slug: consiliency-security-audit
- Skillstore revision: r1
- Version status: missing
- Tree hash: db87f7041b4484bc5cdaade63c8924370c0c1f982194fc21d04e9c063611922b
- Author: Consiliency
- GitHub username: Consiliency
- License: MIT
- Repository: https://github.com/Consiliency/treesitter-chunker/tree/main/.ai-dev-kit/skills/security-audit
- Ref: 635f69fb8d2f4e6330ba47a4e5a0fb239c04d110
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, external\_commands, env\_access
- Quality score: 50
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/consiliency-security-audit
- Manifest: https://skillstore.pages.dev/api/skills/consiliency-security-audit/manifest

## Capabilities

- Reviews code for SQL injection, shell injection, path traversal, hardcoded secrets, cross-site scripting, and broad exception handling.
- Compares vulnerable database operations with parameterized queries and ORM alternatives.
- Explains safer Python exception handling with specific exceptions, logging, chaining, and re-raising.
- Provides detection patterns for Python and TypeScript security reviews.
- Produces severity-ranked findings with locations and remediation guidance.

## Use Cases

- Review a backend change: Check new database, file, and command-handling code before opening a pull request.
- Triage security findings: Classify likely vulnerabilities, explain impact, and propose specific remediations for review.
- Add a release security check: Apply a consistent checklist to sensitive changes before deployment approval.

## Prompt Templates

### Review one file

```
Review this file for common security flaws. Explain each finding, assign severity, cite its location, and suggest a safer approach.
```

### Audit a feature

```
Audit the files for this feature. Focus on trust boundaries, database queries, shell calls, paths, secrets, output encoding, and exception handling.
```

### Validate reported findings

```
Evaluate these security findings against framework behavior and data flow. Separate confirmed vulnerabilities from false positives, then prioritize concrete fixes.
```

### Perform a threat-driven audit

```
Map entry points, untrusted inputs, privileged operations, and sensitive data flows. Audit each path, rank exploitability, and propose layered remediation with verification steps.
```

## Limitations

- Pattern-based review cannot prove that a codebase is free of vulnerabilities.
- Examples focus mainly on Python and TypeScript, with limited framework-specific analysis.
- The skill does not include a runnable scanner, so results depend on the files and context provided.
- The referenced shell-injection cookbook is not included in this package.

## Best Practices

- Provide the relevant source files, framework versions, trust boundaries, and expected data flow.
- Confirm framework-specific escaping and parameterization behavior before accepting or dismissing a finding.
- Review high-impact findings manually and test each remediation against realistic hostile input.

## Anti Patterns

- Do not treat every regular-expression match as a confirmed vulnerability.
- Do not run active scanners against any target without explicit approval and authorization.
- Do not include live credentials, tokens, or sensitive customer data in prompts or reports.

## Security Audit

- Audited at: 2026-07-13T17:01:40.149\+00:00
- Summary: Most static findings are false positives caused by educational Markdown, detection regular expressions, and intentionally vulnerable examples. The audit confirms a predictable API key fallback and finds missing shell-injection guidance plus active testing instructions without authorization controls.

## Stats

- Views: 445
- Downloads: 9
- Favorites: 0
- Popularity score: 0