security-audit

# Security Audit ## When to use Invoke this skill whenever untrusted or security-sensitive code is added, changed, or about to be merged. ## Steps 1. Enumerate entry points: HTTP handlers, CLI args, deserialization, `eval`/`exec`, file uploads. 2. Trace user input to dangerous sinks: SQL, HTML output, shell, file paths, regex. 3. Report each issue with a CWE id, severity, and a minimal fix. 4. Prefer parameterized queries, contextual output encoding, and least privilege. 5. Summarize the top risks and the required follow-ups. ## Examples - "Audit this endpoint for SQL injection" - "Find hardcoded API keys in the repo" ## References Anchor findings in the OWASP Top 10; avoid noisy false positives by confirming a real data flow from source to sink.