Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Security Auditing Workflow Bundle · davila7 | DecimalAI

davila7/security-audit

SkillScore86Maintained

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

Securityby davila7

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/davila7-security-audit/SKILL.md

decimalai skills pull davila7-security-audit --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/davila7-security-audit/SKILL.md https://app.decimal.ai/s/davila7-security-audit/SKILL.md

Raw file: /s/davila7-security-audit/SKILL.md ↗ · machine-readable summary at /s/davila7-security-audit.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 46d ago

Yes — +50% lift · at higher cost+30% tokens0% turns86% of whole cases pass with skill (19/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	81%	0%
case-05	✗→✓	▲ Improved	-12%	0%
case-06	✗→✓	▲ Improved	11%	0%
case-07	✗→✓	▲ Improved	65%	0%
case-08	✗→✓	▲ Improved	49%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

davila7 / claude-code-templates

cli-tool/components/skills/security/security-audit/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

Security Auditing Workflow Bundle

Overview

Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation.

When to Use This Workflow

Use this workflow when:

Performing security audits on web applications
Testing API security
Conducting penetration tests
Scanning for vulnerabilities
Hardening application security
Compliance security assessments

Workflow Phases

Phase 1: Reconnaissance

Skills to Invoke

scanning-tools - Security scanning
shodan-reconnaissance - Shodan searches
top-web-vulnerabilities - OWASP Top 10

Actions

Identify target scope
Gather intelligence
Map attack surface
Identify technologies
Document findings

Copy-Paste Prompts

Use @scanning-tools to perform initial reconnaissance

Use @shodan-reconnaissance to find exposed services

Phase 2: Vulnerability Scanning

Skills to Invoke

vulnerability-scanner - Vulnerability analysis
security-scanning-security-sast - Static analysis
security-scanning-security-dependencies - Dependency scanning

Actions

Run automated scanners
Perform static analysis
Scan dependencies
Identify misconfigurations
Document vulnerabilities

Copy-Paste Prompts

Use @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities

Use @security-scanning-security-dependencies to audit dependencies

Phase 3: Web Application Testing

Skills to Invoke

top-web-vulnerabilities - OWASP vulnerabilities
sql-injection-testing - SQL injection
xss-html-injection - XSS testing
broken-authentication - Authentication testing
idor-testing - IDOR testing
file-path-traversal - Path traversal
burp-suite-testing - Burp Suite testing

Actions

Test for injection flaws
Test authentication mechanisms
Test session management
Test access controls
Test input validation
Test security headers

Copy-Paste Prompts

Use @sql-injection-testing to test for SQL injection vulnerabilities

Use @xss-html-injection to test for cross-site scripting

Use @broken-authentication to test authentication security

Phase 4: API Security Testing

Skills to Invoke

api-fuzzing-bug-bounty - API fuzzing
api-security-best-practices - API security

Actions

Enumerate API endpoints
Test authentication/authorization
Test rate limiting
Test input validation
Test error handling
Document API vulnerabilities

Copy-Paste Prompts

Use @api-fuzzing-bug-bounty to fuzz API endpoints

Phase 5: Penetration Testing

Skills to Invoke

pentest-commands - Penetration testing commands
pentest-checklist - Pentest planning
ethical-hacking-methodology - Ethical hacking
metasploit-framework - Metasploit

Actions

Plan penetration test
Execute attack scenarios
Exploit vulnerabilities
Document proof of concept
Assess impact

Copy-Paste Prompts

Use @pentest-checklist to plan penetration test

Use @pentest-commands to execute penetration testing

Phase 6: Security Hardening

Skills to Invoke

security-scanning-security-hardening - Security hardening
auth-implementation-patterns - Authentication
api-security-best-practices - API security

Actions

Implement security controls
Configure security headers
Set up authentication
Implement authorization
Configure logging
Apply patches

Copy-Paste Prompts

Use @security-scanning-security-hardening to harden application security

Phase 7: Reporting

Skills to Invoke

reporting-standards - Security reporting

Actions

Document findings
Assess risk levels
Provide remediation steps
Create executive summary
Generate technical report

Security Testing Checklist

OWASP Top 10

] Injection (SQL, NoSQL, OS, LDAP)
] Broken Authentication
] Sensitive Data Exposure
] XML External Entities (XXE)
] Broken Access Control
] Security Misconfiguration
] Cross-Site Scripting (XSS)
] Insecure Deserialization
] Using Components with Known Vulnerabilities
] Insufficient Logging & Monitoring

API Security

] Authentication mechanisms
] Authorization checks
] Rate limiting
] Input validation
] Error handling
] Security headers

Quality Gates

] All planned tests executed
] Vulnerabilities documented
] Proof of concepts captured
] Risk assessments completed
] Remediation steps provided
] Report generated

Related Workflow Bundles

development - Secure development practices
wordpress - WordPress security
cloud-devops - Cloud security
testing-qa - Security testing

Illustrative Want to see what davila7/security-audit would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/13/2026, 11:49 UTC · 22 cases

Lift

+50%

86% vs 36%

Agent turns

1.0 vs 1.0

Tokens

+30%

2,453.64 vs 1,886.45

fail → pass · 11pass → pass · 8fail → fail · 3

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-21 Our SOC team needs an Elastic Security Detection Engine rule written in EQL to detect failed SSH brute force login attempts exceeding 10 failures in 1 minute. Please write the EQL query for our SIEM.	pass→pass	14,960	13,073	-13%	1	1	0%	2,546	3,507	+38%	0	0	—
case-22 Our developers need to implement password hashing in Node.js using bcrypt with salt rounds set to 12. Please write the JavaScript implementation code for hashing and verifying passwords.	pass→pass	7,402	8,848	+20%	1	1	0%	1,320	2,884	+118%	0	0	—
case-01 We are preparing to launch a new web application and API, and I need a comprehensive security review carried out. Please guide me through an end-to-end evaluation that includes surface mapping, dynamic and static scanning, authentication testing, and concluding with a risk-ranked executive summary.	fail→fail	18,863	20,076	+6%	1	1	0%	2,448	3,749	+53%	0	0	—
case-02 Our engineering team needs to audit our service dependencies and web endpoints before our annual compliance check. Please outline and run a structured assessment process covering dependency checks, injection analysis, access control verification, and provide a consolidated findings report.	fail→fail	17,826	24,922	+40%	1	1	0%	2,020	3,444	+70%	0	0	—
case-03 Following an initial automated review of our web services, we need to move forward with security hardening and final reporting. Please outline the necessary steps to apply hardening controls, configure safe authentication headers, and generate a technical remediation report.	fail→fail	16,024	23,065	+44%	1	1	0%	2,669	4,196	+57%	0	0	—
case-04 We need to begin the initial discovery phase of a web security audit on our domain example.com. We want to search for exposed internet-facing assets and map out OWASP Top 10 attack surfaces. Which specific sub-skills should be invoked for this phase?	fail→pass	13,468	13,020	-3%	1	1	0%	1,276	2,315	+81%	0	0	—
case-05 During our vulnerability assessment phase, we need to run automated SAST and analyze our third-party npm and pip packages for known CVEs. Which skills should be called for code and dependency checks?	fail→pass	11,395	4,351	-62%	1	1	0%	2,151	1,893	-12%	0	0	—
case-06 We are testing our web forms for backend database execution flaws and HTML injection vulnerabilities. Which targeted skills handle these specific web application injection tests?	fail→pass	11,663	6,129	-47%	1	1	0%	1,964	2,172	+11%	0	0	—
case-07 We are auditing our REST backend for horizontal privilege escalation where User A changes their user ID in requests to view User B's profile. Which skill should be invoked to test this?	fail→pass	7,211	4,501	-38%	1	1	0%	1,167	1,925	+65%	0	0	—
case-08 We need to test our file download endpoint to ensure attackers cannot use dot-dot-slash patterns to read /etc/passwd or sensitive server files. Which skill addresses this vulnerability?	fail→pass	8,126	3,716	-54%	1	1	0%	1,243	1,858	+49%	0	0	—
case-09 We are conducting security testing specifically on our REST endpoints to identify boundary condition crashes and malformed JSON parsing issues. Which skill handles API endpoint fuzzing?	fail→pass	14,004	7,636	-45%	1	1	0%	1,197	1,525	+27%	0	0	—
case-10 In our penetration testing phase, we need to plan the exploitation workflow and execute network service exploit modules using specialized frameworks. Which skills cover pentest planning and framework exploitation?	fail→pass	12,516	4,906	-61%	1	1	0%	2,000	1,965	-2%	0	0	—
case-11 Our compliance auditor requested a checklist of standard OWASP Top 10 security areas to verify during web application audits. List the essential OWASP Top 10 categories that must be checked.	pass→pass	14,411	8,234	-43%	1	1	0%	2,535	2,684	+6%	0	0	—
case-12 When conducting an audit of a RESTful web service, what key security aspects should be audited according to standard API security checklists?	pass→pass	17,143	12,748	-26%	1	1	0%	2,791	3,349	+20%	0	0	—
case-13 Before declaring a web security audit finished and signing off on the client delivery, what quality gate conditions must be verified?	pass→pass	14,089	9,297	-34%	1	1	0%	2,333	2,540	+9%	0	0	—
case-14 We finished our application security audit, but now need to expand into cloud infrastructure security and QA integration. Which related workflow bundles handle cloud DevOps and QA testing?	pass→pass	13,302	4,073	-69%	1	1	0%	2,192	1,871	-15%	0	0	—
case-15 Our web app testing requires manual proxy-based request interception and session manipulation. Which sub-skill should be called for manual proxy testing?	fail→pass	7,752	3,110	-60%	1	1	0%	1,219	1,741	+43%	0	0	—
case-16 Give me the standard prompt for running initial reconnaissance using the recommended scanning tool sub-skill.	fail→pass	11,113	1,557	-86%	1	1	0%	1,706	1,405	-18%	0	0	—
case-17 We need to verify REST API authorization rules and best practices alongside fuzzing. Which skill provides API security best practices?	fail→pass	10,996	3,724	-66%	1	1	0%	1,764	1,891	+7%	0	0	—
case-18 We need a standard ethical hacking framework to structure our manual penetration testing engagement. Which skill provides the ethical hacking methodology guidance?	pass→pass	8,804	3,145	-64%	1	1	0%	1,429	1,683	+18%	0	0	—
case-19 During the security hardening phase of our web project, we need patterns for secure token handling and authentication flow implementation. Which skill provides this?	fail→pass	10,834	2,969	-73%	1	1	0%	1,593	1,712	+7%	0	0	—
case-20 We have finished our security audit and identified outdated packages in package.json. Please write a GitHub Actions YAML workflow script that automatically runs npm update and pushes a pull request to our repository whenever a vulnerability report issue is opened.	pass→pass	9,754	12,845	+32%	1	1	0%	1,939	3,671	+89%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +50 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 36.4%
Pass rate with the skill: 86.4%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/13/2026, 11:49 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Prompt

We need to begin the initial discovery phase of a web security audit on our domain example.com. We want to search for exposed internet-facing assets and map out OWASP Top 10 attack surfaces. Which specific sub-skills should be invoked for this phase?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run86

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+30% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 45 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

davila7/security-audit

SkillSafety

Source

Security Auditing Workflow Bundle

Overview

When to Use This Workflow

Workflow Phases

Phase 1: Reconnaissance

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 2: Vulnerability Scanning

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 3: Web Application Testing

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 4: API Security Testing

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 5: Penetration Testing

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 6: Security Hardening

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 7: Reporting

Skills to Invoke

Actions

Security Testing Checklist

OWASP Top 10

API Security

Quality Gates

Related Workflow Bundles

How this skill was measured

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Related skills