# Audit Systems and Applications Securely

Security reviews require consistent scope, evidence, and remediation guidance across many tools. This skill provides practical workflows for authorized assessment, monitoring, hardening, and reporting.

## Install

```bash
npx skillstore add zl2023github/security-engineer
```

## Metadata

- Status: approved
- Slug: zl2023github-security-engineer
- Skillstore revision: r2
- Version status: missing
- Tree hash: 995b2118c312bbead381edb2369e84034f4aded2f47e364079b75a1a37baf9dc
- Author: zl2023github
- GitHub username: zl2023github
- License: MIT
- Repository: https://github.com/zl2023github/software-engineer-skills/tree/main/software-engineering/security-engineer
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: filesystem, external\_commands, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/zl2023github-security-engineer
- Manifest: https://skillstore.pages.dev/api/skills/zl2023github-security-engineer/manifest

## Capabilities

- Plans authorized security assessments for applications, APIs, infrastructure, cloud environments, containers, and mobile applications.
- Recommends established tools for asset discovery, active scanning, source review, dependency review, and configuration auditing.
- Provides checklists for Web security, authentication, data protection, and infrastructure controls.
- Guides alert triage, forensic analysis, containment, eradication, recovery, and incident review.
- Produces structured findings with severity, evidence, reproduction steps, impact, and remediation guidance.
- Maps common vulnerabilities to detection methods and defensive controls.

## Use Cases

- Review Application Security: Assess code and application behavior, validate scanner findings, and prepare prioritized remediation guidance.
- Build DevSecOps Controls: Select source, dependency, container, and configuration checks for a controlled delivery pipeline.
- Investigate Security Alerts: Organize triage, evidence collection, containment, recovery, and post-incident reporting.

## Prompt Templates

### Create a Security Review Plan

```
Create an authorized security review plan for [system]. Define scope, assumptions, evidence, low-impact checks, approval gates, and report sections.
```

### Review Source Code

```
Review [repository or files] for injection, access control, secret handling, unsafe uploads, SSRF, XXE, and deserialization risks. Explain evidence and fixes.
```

### Design a DevSecOps Pipeline

```
Design security checks for [stack and pipeline]. Include SAST, dependency, secret, container, and configuration scanning with validation and release criteria.
```

### Lead an Incident Investigation

```
Build an incident workflow for [alert and environment]. Prioritize preservation, triage, containment, forensic questions, recovery criteria, communication, and lessons learned.
```

## Limitations

- It does not verify that a target owner granted authorization.
- Tool availability, versions, permissions, and operating system differences can change command behavior.
- Automated scanner results still require manual validation and context-specific risk assessment.
- Some workflows and commands can disrupt services, expose sensitive data, or delete files.

## Best Practices

- Confirm written authorization, exact targets, timing, and stop conditions before active testing.
- Use least-impact checks first and request separate approval before exploitation or destructive actions.
- Redact sensitive evidence, validate automated findings manually, and record reproducible remediation steps.

## Anti Patterns

- Do not scan public or third-party targets without verified authorization.
- Do not run destructive flags or broad filesystem commands without backups, bounded paths, and confirmation.
- Do not report scanner output as confirmed vulnerabilities without manual evidence and impact analysis.

## Security Audit

- Audited at: 2026-07-24T00:04:01.986\+00:00
- Summary: Most critical static alerts are false positives caused by defensive examples, public references, and Markdown syntax. Actionable scanning, sensitive-data inspection, destructive removal, and an unaudited hidden-path script remain confirmed risks. The broad post-exploitation workflow creates additional high dual-use risk despite its authorization reminder.

## Stats

- Views: 1
- Downloads: 7
- Favorites: 0
- Popularity score: 0