vuln-auditlisted

# Vulnerability Audit Most application vulnerabilities are a handful of recurring shapes. This skill teaches Claude to recognize those shapes in real code, explain why each is dangerous, and fix it — producing a severity-ranked report rather than a vague "looks fine." The through-line: **all input is hostile until validated on the server, and all output must be encoded for the context it lands in.** Nearly every bug below is a violation of one of those two rules. ## When to reach for this skill Use it for any explicit security review ("audit this," "find vulnerabilities," "is this safe to ship?") and proactively whenever code handles untrusted input: building database queries, rendering user content, accepting file uploads, making outbound requests from user-supplied URLs, or exposing objects by ID. You don't need the word "vulnerability" — working in these areas is the trigger. ## The audit, by vulnerability class Work through the classes relevant to the code in front of you. For each, the pattern to hunt and the fix are given. Deeper, copyable remediation for each lives in `references/remediation.md` — read it when implementing a fix. ### Injection (SQL / NoSQL / command) Hunt for: user input concatenated into a query or shell command as a string. ``` `SELECT * FROM users WHERE id = ${req.params.id}` // vulnerable ``` Fix: parameterized queries / prepared statements always. With an ORM (Prisma, etc.), use its query builder, never raw string interpolation. For OS c