Auditing Security

The Auditing Security skill is a specialized agentic workflow designed for developers, security engineers, and DevOps teams to perform rigorous code-level security assessments. It automates the detection of common vulnerabilities such as injection flaws (SQL, XSS, Command), broken authentication, access control failures, and cryptographic misconfigurations. By aligning findings with the OWASP Top 10, CVSS scoring, and regulatory frameworks like PCI-DSS and GDPR, the agent ensures that security posture is not just measured but actionable. The tool is effective for both targeted investigation of specific features and comprehensive analysis of entire application codebases.

• Automated vulnerability scanning across multiple attack vectors including injection, data exposure, and insecure dependencies.

• Systematic mapping of findings to OWASP Top 10 categories and CWE identifiers for standardized reporting.

• Generation of professional-grade security audit reports featuring executive summaries, risk-prioritized remediation plans, and specific code-level fix suggestions.

• Support for context-aware analysis using architectural documentation, API contracts, and system design specifications to improve detection accuracy.

• Integration with development lifecycle stages, including pre-deployment security reviews and post-incident forensic investigation.

• Provide the codebase or specific components to be audited to scope the analysis effectively.

• Include supplementary documentation like docs/system-design.md or docs/api-contracts.yaml to help the agent understand authorization models and data flows.

• Inputs expected include the source code, identified threats, and existing security controls (e.g., JWT, RBAC, TLS configuration).

• Outputs are structured to provide immediate remediation guidance, including vulnerable code snippets, exploit scenarios for verification, and severity-ranked fix requirements.

• The agent uses parallel scanning strategies for large codebases to efficiently cover configuration, dependencies, and input sanitization.