Cursor Skill

auditing-security

Perform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns.

LLM Mart · 0 points · 21 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download spencerpauly-awesome-cursor-skills-resources_auditing-security-99cd265.zip · 1 KB

spencerpauly/awesome-cursor-skills 790 140 forks CC0-1.0 Updated 53d ago

Part of spencerpauly/awesome-cursor-skills — 65 skills

Install

skills CLI npx skills add https://github.com/spencerpauly/awesome-cursor-skills/tree/main/resources/auditing-security

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install spencerpauly-awesome-cursor-skills@llmmart

Git git clone https://github.com/spencerpauly/awesome-cursor-skills.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole spencerpauly/awesome-cursor-skills collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Security Audit

Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

Steps

Scan for hardcoded secrets — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like:
- password=, secret=, token=, api_key=
- Base64-encoded credentials
- AWS keys (AKIA...), Stripe keys (sk_live_...), GitHub tokens (ghp_...)
- Files: .env committed to git, config.json with credentials
Check authentication & authorization
- Verify all API routes check authentication before processing.
- Ensure role-based access control is enforced server-side, not just in the UI.
- Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).
- Verify session tokens are HTTP-only, secure, and have reasonable expiry.
Check for injection vulnerabilities
- SQL injection: look for string concatenation in SQL queries instead of parameterized queries.
- XSS: look for dangerouslySetInnerHTML, innerHTML, or unescaped user input rendered in templates.
- Command injection: look for exec(), eval(), child_process.exec() with user input.
- Path traversal: check file operations for unsanitized user input in paths.
Review dependency security
- Run npm audit or pip audit to check for known vulnerabilities.
- Flag outdated dependencies with known CVEs.
- Check for overly permissive dependency ranges.
Check CORS and CSP configuration
- Verify CORS doesn't use Access-Control-Allow-Origin: * in production.
- Check for Content Security Policy headers.
- Verify X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security headers.
Review data exposure
- Check API responses for leaking sensitive fields (password hashes, internal IDs, PII).
- Verify error messages don't expose stack traces or internal details in production.
- Check logging for sensitive data being written to logs.
Generate report — produce a summary with severity ratings (Critical / High / Medium / Low) for each finding, with the file path, line number, and recommended fix.

Notes

This is a code review, not a penetration test. Recommend tools like npm audit, trivy, or snyk for automated scanning.
Always check .gitignore to ensure .env, credentials, and key files are excluded.
For comprehensive auditing, recommend the OWASP Testing Guide.

Files (awesome-cursor-skills)

SKILL.md 2.6 KB

---
name: auditing-security
description: Perform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns.
---

# Security Audit

Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

## Steps

1. **Scan for hardcoded secrets** — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like:
   - `password=`, `secret=`, `token=`, `api_key=`
   - Base64-encoded credentials
   - AWS keys (`AKIA...`), Stripe keys (`sk_live_...`), GitHub tokens (`ghp_...`)
   - Files: `.env` committed to git, `config.json` with credentials

2. **Check authentication & authorization**
   - Verify all API routes check authentication before processing.
   - Ensure role-based access control is enforced server-side, not just in the UI.
   - Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).
   - Verify session tokens are HTTP-only, secure, and have reasonable expiry.

3. **Check for injection vulnerabilities**
   - **SQL injection**: look for string concatenation in SQL queries instead of parameterized queries.
   - **XSS**: look for `dangerouslySetInnerHTML`, `innerHTML`, or unescaped user input rendered in templates.
   - **Command injection**: look for `exec()`, `eval()`, `child_process.exec()` with user input.
   - **Path traversal**: check file operations for unsanitized user input in paths.

4. **Review dependency security**
   - Run `npm audit` or `pip audit` to check for known vulnerabilities.
   - Flag outdated dependencies with known CVEs.
   - Check for overly permissive dependency ranges.

5. **Check CORS and CSP configuration**
   - Verify CORS doesn't use `Access-Control-Allow-Origin: *` in production.
   - Check for Content Security Policy headers.
   - Verify `X-Frame-Options`, `X-Content-Type-Options`, and `Strict-Transport-Security` headers.

6. **Review data exposure**
   - Check API responses for leaking sensitive fields (password hashes, internal IDs, PII).
   - Verify error messages don't expose stack traces or internal details in production.
   - Check logging for sensitive data being written to logs.

7. **Generate report** — produce a summary with severity ratings (Critical / High / Medium / Low) for each finding, with the file path, line number, and recommended fix.

## Notes

- This is a code review, not a penetration test. Recommend tools like `npm audit`, `trivy`, or `snyk` for automated scanning.
- Always check `.gitignore` to ensure `.env`, credentials, and key files are excluded.
- For comprehensive auditing, recommend the OWASP Testing Guide.