Imported from vladm3105/aidoc-flow-framework (platforms/claude-code-plugin/skills/security-audit/SKILL.md). Install upstream with npx skills add vladm3105/aidoc-flow-framework --skill security-audit. Copyright stays with the author.

security-audit

Name: security-audit
Author: vladm3105

Purpose

Ensure security requirements are properly defined, implemented, and tested, and identify vulnerabilities across code, dependencies, infrastructure, and configuration. Validates compliance against recognized standards (OWASP Top 10, CWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat modeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR security topics upstream of it.

When to Use

Use security-audit when:

Reviewing the security posture of an SDD project or its implementation.
Validating that security requirements in SPEC (and upstream EARS/ADR) are complete and testable.
Scanning code, dependencies, infrastructure, or configuration for vulnerabilities, secrets, or compliance gaps.
Performing threat modeling on a component or system.

Do not use it for general (non-security) artifact quality (use ../quality-advisor/SKILL.md) or traceability validation (use ../doc-validator/SKILL.md).

Behavior

The audit runs as a pipeline, producing a single report:

Requirements validation — check security requirements (sourced from SPEC and upstream EARS/ADR) for completeness: authn/authz, data protection, encryption, key management; flag missing or vague requirements.
Code scanning — SAST (bandit, semgrep), dependency CVEs (safety, pip-audit), secret detection (detect-secrets, gitleaks), and pattern checks for injection, XSS, and CSRF. Critical findings block deployment.
Infrastructure scanning — IaC (checkov, tfsec), containers (trivy, grype), Kubernetes, and cloud/network configuration.
Dependency assessment — known CVEs, CVSS scoring, outdated and transitive packages, and license-compliance issues.
Compliance check — OWASP Top 10 (2021) coverage and CWE mapping, plus any applicable regulatory frameworks.
Threat modeling — STRIDE analysis, attack-surface and trust-boundary mapping, with mitigation status per threat.
Report — overall security score, findings grouped by severity (critical/high/medium/low) with file:line, CWE/CVE, CVSS, and fix, plus compliance status and prioritized remediation. Critical issues are marked as deployment blockers.

Targets: zero critical vulnerabilities, no secrets in the repository, 100% coverage of MUST security requirements, OWASP Top 10 fully covered.

Limitations: cannot detect all business-logic flaws, may produce false positives requiring manual review, and depends on current tool vulnerability databases.

Related Resources

SPEC layer: ${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/README.md · ${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/SPEC-TEMPLATE.yaml
Upstream security topics: ${CLAUDE_PLUGIN_ROOT}/framework/layers/03_EARS/README.md · ${CLAUDE_PLUGIN_ROOT}/framework/layers/05_ADR/README.md
Governance: ${CLAUDE_PLUGIN_ROOT}/framework/governance/ (ID, tagging, traceability standards)
Related skills: ../quality-advisor/SKILL.md · ../doc-validator/SKILL.md · ../doc-spec/SKILL.md
References: OWASP Top 10 (2021), CWE, OWASP ASVS

{ "ocm": "1", "id": "vladm3105-aidoc-flow-framework-security-audit", "kind": "skill", "name": "security-audit", "description": "Validate security requirements and assess vulnerabilities across code, dependencies, infrastructure, and configuration, with OWASP/CWE compliance and STRIDE threat modeling. Use to security-review an SDD project or its implementation.", "publisher": "vladm3105", "version": "1.0.0", "capabilities": { "domains": [ "coding", "legal" ], "tags": [ "skill-md", "sdd-workflow", "utility", "quality-assurance", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Validate security requirements and assess vulnerabilities across code, dependencies, infrastructure, and configuration, with OWASP/CWE compliance and STRIDE threat modeling. Use to security-review an SDD project or its implementation." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/vladm3105/aidoc-flow-framework", "path": "platforms/claude-code-plugin/skills/security-audit/SKILL.md", "ref": "HEAD", "url": "https://github.com/vladm3105/aidoc-flow-framework/blob/HEAD/platforms/claude-code-plugin/skills/security-audit/SKILL.md", "key": "vladm3105/aidoc-flow-framework/platforms/claude-code-plugin/skills/security-audit/SKILL.md" } }, "instructions": "# security-audit\n\n## Purpose\n\nEnsure security requirements are properly defined, implemented, and tested, and\nidentify vulnerabilities across code, dependencies, infrastructure, and\nconfiguration. Validates compliance against recognized standards (OWASP Top 10,\nCWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat\nmodeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR\nsecurity topics upstream of it.\n\n## When to Use\n\nUse `security-audit` when:\n\n- Reviewing the security posture of an SDD project or its implementation.\n- Validating that security requirements", "cost": { "context_tokens": 783 } }

security-audit

About

security-audit

Purpose

When to Use

Behavior

Related Resources

Use it

Manifest

Reviews