Auditing Security

The Auditing Security skill provides a comprehensive framework for identifying, analyzing, and remediating software vulnerabilities. Designed for security engineers, developers, and compliance officers, this agentic skill facilitates rigorous security reviews, pre-deployment assessments, and post-incident forensic analysis. By leveraging industry-standard frameworks such as OWASP Top 10, CVSS scoring, and compliance protocols like PCI-DSS, GDPR, and HIPAA, the tool ensures that security posture is evaluated against rigorous benchmarks. It is particularly effective for reviewing architectural design, API specifications, and complex codebase implementations, helping teams move beyond basic linting to identify sophisticated exploit vectors and logic flaws.

• Automated identification of security vulnerabilities including injection (SQLi, XSS, Command), broken access control, and cryptographic failures.

• Structural security review for authentication and authorization workflows, including JWT, RBAC, ABAC, and session management.

• Risk-prioritized remediation planning with actionable code fixes and detailed exploit scenario documentation.

• Compliance-focused analysis mapping findings to OWASP categories, CWE identifiers, and severity-ranked CVSS scoring.

• Parallelized scanning agents that decompose large, complex codebases into targeted review domains (Injection, Data Exposure, Configuration, Dependencies).

• Support for architecture-aware reviews by integrating with system design documents, API contracts, and feature-level implementation specifications.

• Utilize for security-critical development phases, including pre-deployment code reviews and CI/CD pipeline integration.

• Provide context via system-design.md or api-contracts.yaml to improve the accuracy of threat modeling and impact analysis.

• Focus on sensitive data exposure (PII, financial, health information) by explicitly defining the data sensitivity level in the audit query.

• Use the provided Finding Documentation Format to standardize reports, ensuring consistency across audit cycles and team communication.

• Perform continuous monitoring of dependencies by checking for outdated packages, known CVEs, and supply chain risks using automated audit workflows.