security-audit

Audit TypeScript web apps for security issues with file:line evidence.

Updated Aug 27, 2026
One-click install
npx skills add https://github.com/maxbeaudoin/productflash --skill security-audit-maxbeaudoin
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/maxbeaudoin/productflash/tree/main/.claude/skills/security-audit
Command: npx skills add https://github.com/maxbeaudoin/productflash --skill security-audit-maxbeaudoin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you systematically uncover security weaknesses in a web or SaaS codebase and translate them into prioritized, evidence-backed findings you can act on.

Core Features & Use Cases

  • Comprehensive, read-only audit workflow: Guides a phased review across auth/session, authorization & tenant isolation, input injection vectors, common OWASP risks, secrets handling, LLM-specific abuse, and dependencies.
  • Evidence-first reporting: Requires concrete findings with file:line references and short code excerpts rather than speculative guidance.
  • Ranked remediation output: Produces one consolidated report with severity, likelihood, impact, attacker scenario framing, and specific remediation recommendations.

Quick Start

Ask for a security audit of your repository and request a single ranked report with evidence in file:line format, using the skill's read-only methodology.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on a TypeScript web app to find real vulnerabilities?▼

Run a security audit by requesting a read-only review of your TypeScript web app, which produces a comprehensive report with concrete file-and-line evidence for issues like injection vectors and weak authorization.

What is the best way to check tenant isolation and authorization logic for security flaws?▼

The best way to check tenant isolation is using an evidence-first security audit that reviews your authorization logic and outputs ranked findings with severity, impact, and specific remediation recommendations.

Can I detect LLM prompt injection and dependency supply chain risks during a code review?▼

Yes, you can detect LLM prompt injection and dependency supply chain risks by applying a phased audit workflow that scans for LLM-specific abuse surfaces and vulnerable dependencies in your codebase.

Does a security audit report provide exact file and line references for identified issues?▼

A security audit report does provide exact file and line references, requiring concrete code excerpts and evidence-first findings rather than speculative guidance to ensure actionable remediation.

How are security findings prioritized when reviewing code for XSS, CSRF, and SSRF vulnerabilities?▼

Security findings for XSS, CSRF, and SSRF vulnerabilities are prioritized using a ranked output that includes severity, likelihood, impact, and attacker scenario framing to guide your remediation efforts.

When should I expect verification needed notes in my web application security audit report?▼

You should expect verification needed notes in your security audit report when runtime proof is unavailable, ensuring that findings requiring dynamic testing are clearly flagged for further validation.