Skills Guide

Security Audit Triage

VerifiedCaution

Map pentest reports and CVEs to code, classify findings with evidence, assess API risk, and get prioritized fix scope. Read-only analysis before security fixes.

Download and use
Sby Skills Guide Bot
SecurityIntermediate
7/24/2026
Claude Code
#security-audit#vulnerability-triage#owasp#pentest#static-analysis

Recommended for

Claude Code

Automated summary

A read-only analysis that maps a pentest report or CVEs onto the actual codebase, classifying each finding as confirmed, partially confirmed, or not confirmed with file:line evidence.

Strengths

  • Assigns each finding a status based on real code instead of copying severities from the external report
  • Covers attack surface (API, storage, proxy, dependencies) and OWASP Top 10 patterns including injection, XSS, and auth bypass
  • Delivers a findings matrix, a P0/P1 remediation scope, and an explicit list of runtime-risky changes
  • Stays strictly read-only until implementation is explicitly approved

Limitations

  • Fixes nothing: the output stops at analysis and a fix backlog
  • No exploitation or dynamic testing, only code reading and allowlisted shell commands
  • Workflow steps and trigger phrases are written in Russian
  • Quality depends heavily on the accuracy of the pentest report or CVEs supplied as input
When to use it

Use it before opening security fix tickets, to confirm which pentest findings or CVEs actually apply to the current codebase.

When not to use it

Do not use it to apply fixes, run dynamic testing, or perform broad dependency auditing.

Security analysis

Caution
Quality score80/100

The skill is framed as a read-only security triage workflow and contains no destructive, obfuscated, or exfiltration instructions. However, its declared tool permissions include powerful execution and network capabilities such as curl, npm run, npx, and fuser. These are legitimate for security analysis but could be misused, so the listing warrants caution rather than a safe rating.

Findings
  • •Allowed Bash(curl *) permits arbitrary network requests and could be misused for data exfiltration, despite the skill's read-only framing.
  • •Allowed Bash(npm run *) and Bash(npx vitest/tsc/eslint *) can execute project scripts or fetched packages, which may run arbitrary code.
  • •Allowed Bash(fuser *) can terminate processes if used with options like -k, which is not clearly restricted by the read-only description.
  • •The tool allowlist is broader than the stated read-only analysis intent and is not technically enforced by the skill instructions.
How this analysis is made

Examples

Validate a pentest report
Here is the summary section of our pentest report: [paste findings]. Map each finding to the actual code, mark it as confirmed / partially confirmed / not confirmed with file:line evidence, and give me a realistic P0/P1 fix scope.
Check a flagged CVE
CVE-2024-21538 was flagged in our dependency tree. Check whether the vulnerable code path is actually reachable in this repo, assign a status with evidence, and tell me if it is P0/P1 or can be deferred.
Russian trigger
Проверь security аудит: подтверди findings из отчёта, оцени поверхность атаки по API и выдай матрицу со статусами и ссылками на файлы.

name: security-audit-triage description: "Map pentest reports and CVEs to real code. Classify each as confirmed/partial/not confirmed with file:line evidence. Assess API risk (injection, XSS, auth bypass), check OWASP Top 10 patterns, evaluate attack surface. Get prioritized P0/P1 fix scope. Read-only analysis — use before any security fix work." user-invocable: true allowed-tools:

  • Read
  • Bash(git *)
  • Bash(ls *)
  • Bash(find *)
  • Bash(grep *)
  • Bash(cat *)
  • Bash(head *)
  • Bash(tail *)
  • Bash(sort *)
  • Bash(uniq *)
  • Bash(wc *)
  • Bash(npm run *)
  • Bash(npm audit *)
  • Bash(npx vitest *)
  • Bash(npx tsc *)
  • Bash(npx eslint *)
  • Bash(curl *)
  • Bash(fuser *)
  • Bash(rg *)
  • Bash(jq *)

Skill: Security Audit Triage

Triggers

  • "проверь security аудит"
  • "валидация отчета"
  • "подтверди findings"

Objective

Отделить подтвержденные риски от гипотез и подготовить реалистичный backlog фиксов без over-engineering.

Workflow

  1. Собрать attack surface и точки входа (API, storage, proxy, deps).
  2. Проверить каждый finding в коде и присвоить статус:
    • confirmed
    • partially confirmed
    • not confirmed
  3. Пересчитать severity с учетом текущего runtime контекста проекта.
  4. Сформировать минимальный safe remediation set (P0/P1) и deferred set (P2).
  5. Зафиксировать результат в report + ссылками на файлы.

Constraints

  • Reviewer-mode: read-only до explicit подтверждения на implementation.
  • Не копировать severity из внешнего отчета без проверки.
  • Учитывать текущую архитектуру (SQL-first, reverse proxy, launch constraints).

Output

  • Findings matrix (status, adjusted severity, evidence)
  • P0/P1 remediation scope
  • Explicit list of risky changes that can break runtime

Handoff

  • Success condition: findings matrix готова, P0/P1 scope зафиксирован.
  • Next: security-hardening-pass (при наличии confirmed P0/P1)
  • Auto-proceed: 🟢 YES (переход к hardening без паузы)
  • Hard stop: NO

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/security-audit-triage-mryiqgxf/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/security-audit-triage-mryiqgxf' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/security-audit-triage-mryiqgxf/download' --output '.skill-downloads/security-audit-triage-mryiqgxf/SKILL.md.part' && mv '.skill-downloads/security-audit-triage-mryiqgxf/SKILL.md.part' '.skill-downloads/security-audit-triage-mryiqgxf/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/security-audit-triage-mryiqgxf/SKILL.md' && test -s '.skill-downloads/security-audit-triage-mryiqgxf/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/security-audit-triage' && cp -R '.skill-downloads/security-audit-triage-mryiqgxf' '.claude/skills/security-audit-triage'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/security-audit-triage-mryiqgxf'

openskills read 'security-audit-triage-mryiqgxf'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/security-audit-triage-mryiqgxf/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

DeFi AMM Security

Security

Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, donation attacks, oracle manipulation, slippage, and integer math.

Claude CodeCursorCodexadvancedSafe 243,989
Skills Guide Bot

Semgrep Rule Creator

Security

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Includes test-first methodology, taint mode support, and validation steps. Helps when building targeted static analysis detections.

Claude CodeintermediateSafe 21,468
Skills Guide Bot

Dev Toolbar Review Guide

Security

Safety rules for the dev toolbar, PostHog client, and feature flags. Use when reviewing changes to dev-tools and related files, covering environment guards, override cookies, and SSE stream safety.

Claude CodeCursorCodexintermediateSafe 108,624
Skills Guide Bot