Audit Systems and Applications Securely
Security reviews require consistent scope, evidence, and remediation guidance across many tools. This skill provides practical workflows for authorized assessment, monitoring, hardening, and reporting.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "security-engineer" from https://skillstore.io/skills/zl2023github-security-engineer.md and its manifest at https://skillstore.io/api/skills/zl2023github-security-engineer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "security-engineer". Assess an internal API after written authorization and provide a review plan.
Expected outcome:
Using "security-engineer". Summarize a confirmed broken access control issue for an engineering team.
Expected outcome:
High severity: a standard user can access another account record by changing its identifier. Enforce server-side ownership checks and add negative authorization tests.
Using "security-engineer". Prepare an incident response checklist for suspicious authentication activity.
Expected outcome:
Most critical static alerts are false positives caused by defensive examples, public references, and Markdown syntax. Actionable scanning, sensitive-data inspection, destructive removal, and an unaudited hidden-path script remain confirmed risks. The broad post-exploitation workflow creates additional high dual-use risk despite its authorization reminder.
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/zl2023github-security-engineer/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/zl2023github-security-engineer?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/zl2023github-security-engineer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zl2023github-security-engineer/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/zl2023github-security-engineer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>zl2023github. (2026). security-engineer security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zl2023github-security-engineer/audits/4@techreport{zl2023github-zl2023github-security-engineer-2026,
author = {zl2023github},
title = {security-engineer security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/zl2023github-security-engineer/audits/4},
note = {Author version unspecified}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-engineer security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "zl2023github"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/zl2023github-security-engineer/audits/4"
identifiers:
- type: other
value: "skillstore:zl2023github-security-engineer:audit:4"
description: "Skillstore immutable audit report identifier"
Assess code and application behavior, validate scanner findings, and prepare prioritized remediation guidance.
Select source, dependency, container, and configuration checks for a controlled delivery pipeline.
Organize triage, evidence collection, containment, recovery, and post-incident reporting.
Create an authorized security review plan for [system]. Define scope, assumptions, evidence, low-impact checks, approval gates, and report sections.
Review [repository or files] for injection, access control, secret handling, unsafe uploads, SSRF, XXE, and deserialization risks. Explain evidence and fixes.
Design security checks for [stack and pipeline]. Include SAST, dependency, secret, container, and configuration scanning with validation and release criteria.
Build an incident workflow for [alert and environment]. Prioritize preservation, triage, containment, forensic questions, recovery criteria, communication, and lessons learned.
Author
zl2023githubLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
88a8e9a07f4c54ab105c1c41b6267c287146b07b
Maintenance freshness
7/26/2026
Usage
2 downloads · 1 views
File structure
Diagnose and Improve Full-Stack Performance
Full-stack teams often lack a repeatable way to measure performance and locate bottlenecks. This skill provides testing workflows, diagnostic commands, optimization guidance, and report structures.
Build and Optimize Search Systems
Search teams need reliable guidance across indexing, ranking, semantic retrieval, and evaluation. This skill provides practical workflows and examples for building and improving search systems.
Design Reliable Payment Systems
Payment teams need consistent designs for transactions, channels, reconciliation, security, and failure handling. This skill provides structured guidance, examples, and review checklists.
Build Reliable Business Intelligence Analysis
Business teams often lack consistent metrics and repeatable analysis workflows. This skill guides SQL, Python, dashboards, experiments, and automated reporting from requirements to delivery.
Evaluate Technology Choices with Clear Tradeoffs
Technology choices often hide tradeoffs across performance, cost, reliability, operations, and team readiness. This skill compares candidates, recommends an option, and defines proof-of-concept checks.
Generate Clear Software Architecture Documents
Architecture decisions often remain scattered across requirements, discussions, and diagrams. This skill organizes them into consistent Markdown documents for implementation and review.
Automate SecOps Checks
by alirezarezvani
Security teams need consistent review workflows across projects. This skill provides SecOps CLI scaffolds and reference guides for repeatable checks.
Strengthen Security Engineering Decisions
by 89jobrien
Security work often spans architecture, identity, compliance, testing, and response planning. This skill gives Claude, Codex, and Claude Code structured security engineering guidance.
Audit Software Releases with Evidence
by glenskii
Release decisions often rely on incomplete evidence and inconsistent standards. This skill applies structured controls, deterministic scoring, and mandatory gates to assess readiness.
Audit ISO 27001 ISMS Controls
by alirezarezvani
ISMS audits require clear scope, evidence, and risk-based priorities. This skill guides ISO 27001 audit planning, control testing, and readiness work.
Strengthen Application Security Reviews
by alirezarezvani
Security reviews often lack consistent checklists and reusable workflows. This skill provides security review scaffolds, reference guidance, and simple reporting scripts for Claude, Codex, and Claude Code.
Build pytm Threat Models as Code
by AgentSecOps
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.