Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Security Auditing Workflow Bundle — measured AI agent skill | DecimalAI

sickn33/security-audit

NewSkillScoreMaintained

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

Securityby sickn33

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

decimalai skills pull sickn33-security-audit

Get this skill — curl · raw file

curl -fsSL https://app.decimal.ai/s/sickn33-security-audit/SKILL.md

Raw file: /s/sickn33-security-audit/SKILL.md ↗ · machine-readable summary at /s/sickn33-security-audit.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 6h ago

Yes — +41% lift+22% tokens0% turns59% of whole cases pass with skill (13/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-09	✗→✓	▲ Improved	20%	0%
case-04	✗→✓	▲ Improved	24%	0%
case-05	✗→✓	▲ Improved	19%	0%
case-06	✗→✓	▲ Improved	34%	0%
case-08	✗→✓	▲ Improved	-3%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

sickn33 / agentic-awesome-skills

skills/security-audit/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

Security Auditing Workflow Bundle

Overview

Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation.

When to Use This Workflow

Use this workflow when:

Performing security audits on web applications
Testing API security
Conducting penetration tests
Scanning for vulnerabilities
Hardening application security
Compliance security assessments

Workflow Phases

Phase 1: Reconnaissance

Skills to Invoke

scanning-tools - Security scanning
shodan-reconnaissance - Shodan searches
top-web-vulnerabilities - OWASP Top 10

Actions

Identify target scope
Gather intelligence
Map attack surface
Identify technologies
Document findings

Copy-Paste Prompts

Use @scanning-tools to perform initial reconnaissance

Use @shodan-reconnaissance to find exposed services

Phase 2: Vulnerability Scanning

Skills to Invoke

vulnerability-scanner - Vulnerability analysis
security-scanning-security-sast - Static analysis
security-scanning-security-dependencies - Dependency scanning

Actions

Run automated scanners
Perform static analysis
Scan dependencies
Identify misconfigurations
Document vulnerabilities

Copy-Paste Prompts

Use @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities

Use @security-scanning-security-dependencies to audit dependencies

Phase 3: Web Application Testing

Skills to Invoke

top-web-vulnerabilities - OWASP vulnerabilities
sql-injection-testing - SQL injection
xss-html-injection - XSS testing
broken-authentication - Authentication testing
idor-testing - IDOR testing
file-path-traversal - Path traversal
burp-suite-testing - Burp Suite testing

Actions

Test for injection flaws
Test authentication mechanisms
Test session management
Test access controls
Test input validation
Test security headers

Copy-Paste Prompts

Use @sql-injection-testing to test for SQL injection vulnerabilities

Use @xss-html-injection to test for cross-site scripting

Use @broken-authentication to test authentication security

Phase 4: API Security Testing

Skills to Invoke

api-fuzzing-bug-bounty - API fuzzing
api-security-best-practices - API security

Actions

Enumerate API endpoints
Test authentication/authorization
Test rate limiting
Test input validation
Test error handling
Document API vulnerabilities

Copy-Paste Prompts

Use @api-fuzzing-bug-bounty to fuzz API endpoints

Phase 5: Penetration Testing

Skills to Invoke

pentest-commands - Penetration testing commands
pentest-checklist - Pentest planning
ethical-hacking-methodology - Ethical hacking
metasploit-framework - Metasploit

Actions

Plan penetration test
Execute attack scenarios
Exploit vulnerabilities
Document proof of concept
Assess impact

Copy-Paste Prompts

Use @pentest-checklist to plan penetration test

Use @pentest-commands to execute penetration testing

Phase 6: Security Hardening

Skills to Invoke

security-scanning-security-hardening - Security hardening
auth-implementation-patterns - Authentication
api-security-best-practices - API security

Actions

Implement security controls
Configure security headers
Set up authentication
Implement authorization
Configure logging
Apply patches

Copy-Paste Prompts

Use @security-scanning-security-hardening to harden application security

Phase 7: Reporting

Skills to Invoke

reporting-standards - Security reporting

Actions

Document findings
Assess risk levels
Provide remediation steps
Create executive summary
Generate technical report

Security Testing Checklist

OWASP Top 10

] Injection (SQL, NoSQL, OS, LDAP)
] Broken Authentication
] Sensitive Data Exposure
] XML External Entities (XXE)
] Broken Access Control
] Security Misconfiguration
] Cross-Site Scripting (XSS)
] Insecure Deserialization
] Using Components with Known Vulnerabilities
] Insufficient Logging & Monitoring

API Security

] Authentication mechanisms
] Authorization checks
] Rate limiting
] Input validation
] Error handling
] Security headers

Quality Gates

] All planned tests executed
] Vulnerabilities documented
] Proof of concepts captured
] Risk assessments completed
] Remediation steps provided
] Report generated

Related Workflow Bundles

development - Secure development practices
wordpress - WordPress security
cloud-devops - Cloud security
testing-qa - Security testing

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Want to see if sickn33/security-audit would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

sickn33/security-audit

SkillSafety

Source

Security Auditing Workflow Bundle

Overview

When to Use This Workflow

Workflow Phases

Phase 1: Reconnaissance

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 2: Vulnerability Scanning

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 3: Web Application Testing

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 4: API Security Testing

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 5: Penetration Testing

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 6: Security Hardening

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 7: Reporting

Skills to Invoke

Actions

Security Testing Checklist

OWASP Top 10

API Security

Quality Gates

Related Workflow Bundles

Limitations

Related skills