Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on file changes. Scans for SQL injection, XSS, secrets exposure, auth issues. Triggers on file changes, security mentions, deployment prep.

Security Auditor Skill Automatic security vulnerability detection. When I Activate ✅ Code files modified (especially auth, API, database) ✅ User mentions security or vulnerabilities ✅ Before deployments or commits ✅ Dependency changes ✅ Configuration file changes What I Scan For OWASP Top 10 Patterns 1. SQL Injection 2. XSS (Cross Site Scripting) 3. Authentication Issues 4. Sensitive Data Exposure 5. Broken Access Control Additional Security Checks Insecure Deserialization Security Misconfiguration Insufficient Logging CSRF Protection Missing CORS Misconfiguration Alert Format Severity Levels 🚨 CRITICAL : Must fix immediately (exploitable vulnerabilities) ⚠️ HIGH : Should fix soon (security weaknesses) 📋 MEDIUM : Consider fixing (potential issues) 💡 LOW : Best practice improvements Real World Examples SQL Injection Detection Password Storage API Key Exposure Dependency Scanning I can run security audits on dependencies: Relationship with @code reviewer Sub Agent Me (Skill): Quick vulnerability pattern detection @code reviewer (Sub Agent): Deep security audit with threat modeling Workflow 1. I detect vulnerability pattern 2. I flag: "🚨 SQL injection detected" 3. You want full analysis → Invoke @code reviewer sub agent 4. Sub agent provides comprehensive security audit Common Vulnerability Patterns Authentication Weak password policies Missing MFA Session fixation Insecure password storage Authorization Missing access control Privilege escalation IDOR (Insecure Direct Object Reference) Data Protection Unencrypted sensitive data Weak encryption algorithms Missing HTTPS Insecure cookies Input Validation SQL injection Command injection XSS Path traversal Sandboxing Compatibility Works without sandboxing: ✅ Yes Works with sandboxing: ✅ Yes Optional: For dependency scanning Integration with Tools With secret scanner Skill With /review Command Customization Add company specific security patterns: Learn More [OWASP Top 10](https://owasp.org/www project top ten/) [CWE Top 25](https://cwe.mitre.org/top25/) [Security Best Practices](../../standards/security/)

security-auditor