# Run Security Audits with AI Agents

Security reviews often miss issues spread across code, dependencies, runtime behavior, and secrets. This skill guides Claude, Codex, and Claude Code through a structured audit workflow with reporting gates.

## Install

```bash
npx skillstore add dnyoussef/when-auditing-security-use-security-analyzer
```

## Metadata

- Status: approved
- Slug: dnyoussef-when-auditing-security-use-security-analyzer
- Version: 1.0.0
- Author version: 1.0.0
- Skillstore revision: r1
- Version status: valid
- Tree hash: dff590650beb58bba490c6478f782bb80d9020e8681ae0c592b6dc605db0908f
- Author: DNYoussef
- GitHub username: DNYoussef
- License: MIT
- Repository: https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/security/when-auditing-security-use-security-analyzer
- Ref: 1ffa7643651792ccb4bd3b15d924d2c97edff755
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, scripts, external\_commands, filesystem, env\_access
- Quality score: 70
- Public page: https://skillstore.pages.dev/skills/dnyoussef-when-auditing-security-use-security-analyzer
- Manifest: https://skillstore.pages.dev/api/skills/dnyoussef-when-auditing-security-use-security-analyzer/manifest

## Capabilities

- Scans JavaScript and TypeScript code for SQL injection, XSS, path traversal, and weak cryptography patterns.
- Runs dependency checks with npm audit when a package.json file is present.
- Searches local project files for common API keys, passwords, and credential patterns.
- Checks a local application endpoint for optional dynamic testing readiness.
- Generates a markdown security report with severity counts and remediation guidance.
- Can compare current results with a baseline report to highlight regressions.

## Use Cases

- Pre-merge security review: Run a local scan before opening a pull request to catch common injection, secrets, and dependency issues.
- Release readiness audit: Combine static checks, npm audit results, and OWASP scoring into one report before a release.
- Security learning workflow: Use documented vulnerable and safe examples to teach teams how common web security issues appear in code.

## Prompt Templates

### Run a basic static scan

```
Use the security analyzer to run a static scan on this project and summarize the most important findings.
```

### Check secrets and dependencies

```
Run secrets detection and dependency auditing, then tell me which findings need immediate action.
```

### Compare against a baseline

```
Run the security analyzer against this codebase and compare the results with my existing baseline report.
```

### Perform a full release audit

```
Run the full security analyzer workflow with strict mode, include OWASP coverage, and produce a prioritized remediation plan.
```

## Limitations

- Dynamic testing is limited to local application checks and placeholder routines unless extended by the user.
- Pattern-based scanning can produce false positives and requires human review.
- The shell workflow assumes common Unix tools such as grep, jq, npm, curl, and bc are available.
- It does not replace a full professional penetration test or threat model.

## Best Practices

- Run scans only on repositories and local services you are authorized to test.
- Review each finding manually before treating it as a confirmed vulnerability.
- Store generated reports securely because they can include sensitive file paths or code snippets.

## Anti Patterns

- Do not run dynamic or rate-limit tests against third-party systems without written permission.
- Do not paste generated reports into public tools when they contain secrets or internal paths.
- Do not treat grep-based results as complete coverage for complex security issues.

## Security Audit

- Audited at: 2026-07-09T04:09:35.723\+00:00
- Summary: The static matches are overwhelmingly scanner signatures, documentation examples, local temporary-file usage, or local audit commands rather than malicious behavior. I did not find evidence of credential exfiltration, destructive actions, prompt injection, or unauthorized remote targeting, but the skill does execute external tooling and can generate sensitive local reports. Static review was capped at 400/481 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

## Stats

- Views: 212
- Downloads: 8
- Favorites: 0
- Popularity score: 0