Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

Security Auditing Workflow Bundle ⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited. Mandatory confirmation gate Before each active security action, state the exact target URL, IP, account, or resource, the written authorization confirmation, permitted scope, exact command, expected effect and limits. Without confirmation, remain read only and provide defensive guidance only. Wait for explicit confirmation in the current conversation before executing it. Existing scope does not authorize expanding targets or techniques. Overview Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation. When to Use This Workflow Use this workflow when: Performing security audits on web applications Testing API security Conducting penetration tests Scanning for vulnerabilities Hardening application security Compliance security assessments Before active testing, obtain written authorization naming exact targets, accounts, techniques, time window, request/concurrency/byte limits, prohibited actions and stop conditions. Select approved phases rather than launching every referenced skill. Use owned test fixtures for injections, exploitation and account actions; never extract real customer data or persist access to prove impact. Static source/dependency review may proceed within authorized read scope. Separate suspected scanner signals from reproduced findings, preserve redacted evidence and record untested scope. Workflow Phases Phase 1: Reconnaissance Skills to Invoke scanning tools Security scanning shodan reconnaissance Shodan searches top web vulnerabilities OWASP Top 10 Actions 1. Identify target scope 2. Gather intelligence 3. Map attack surface 4. Identify technologies 5. Document findings Copy Paste Prompts Phase 2: Vulnerability Scanning Skills to Invoke vulnerability scanner Vulnerability analysis security scanning security sast Static analysis security scanning security dependencies Dependency scanning Actions 1. Run automated scanners 2. Perform static analysis 3. Scan dependencies 4. Identify misconfigurations 5. Document vulnerabilities Copy Paste Prompts Phase 3: Web Application Testing Skills to Invoke top web vulnerabilities OWASP vulnerabilities sql injection testing SQL injection xss html injection XSS testing broken authentication Authentication testing idor testing IDOR testing file path traversal Path traversal burp suite testing Burp Suite testing Actions 1. Test for injection flaws 2. Test authentication mechanisms 3. Test session management 4. Test access controls 5. Test input validation 6. Test security headers Copy Paste Prompts Phase 4: API Security Testing Skills to Invoke api fuzzing bug bounty API fuzzing api security best practices API security Actions 1. Enumerate API endpoints 2. Test authentication/authorization 3. Test rate limiting 4. Test input validation 5. Test error handling 6. Document API vulnerabilities Copy Paste Prompts Phase 5: Penetration Testing Skills to Invoke pentest commands Penetration testing commands pentest checklist Pentest planning ethical hacking methodology Ethical hacking metasploit framework Metasploit Actions 1. Plan penetration test 2. Execute attack scenarios 3. Exploit vulnerabilities 4. Document proof of concept 5. Assess impact Copy Paste Prompts Phase 6: Security Hardening Skills to Invoke security scanning security hardening Security hardening auth implementation patterns Authentication api security best practices API security Actions 1. Implement security controls 2. Configure security headers 3. Set up authentication 4. Implement authorization 5. Configure logging 6. Apply patches Copy Paste Prompts Phase 7: Reporting Skills to Invoke reporting standards Security reporting Actions 1. Document findings 2. Assess risk levels 3. Provide remediation steps 4. Create executive summary 5. Generate technical report Security Testing Checklist Vulnerability coverage (historical OWASP style checklist) [ ] Injection (SQL, NoSQL, OS, LDAP) [ ] Broken Authentication [ ] Sensitive Data Exposure [ ] XML External Entities (XXE) [ ] Broken Access Control [ ] Security Misconfiguration [ ] Cross Site Scripting (XSS) [ ] Insecure Deserialization [ ] Using Components with Known Vulnerabilities [ ] Insufficient Logging & Monitoring API Security [ ] Authentication mechanisms [ ] Authorization checks [ ] Rate limiting [ ] Input validation [ ] Error handling [ ] Security headers Quality Gates [ ] All planned tests executed [ ] Vulnerabilities documented [ ] Proof of concepts captured [ ] Risk assessments completed [ ] Remediation steps provided [ ] Report generated Related Workflow Bundles development Secure development practices wordpress WordPress security cloud devops Cloud security testing qa Security testing Limitations Use this skill only when the task clearly matches the scope described above. Do not treat the output as a substitute for environment specific validation, testing, or expert review. Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

security-audit