skills.rest
HKU-MMLab
HKU-MMLabOFFICIAL
Explore all skills by this author →
GitHub

security-auditor

Reviews code for OWASP Top 10 vulnerabilities and provides structured security audit reports.

39|1|Updated Jul 2, 2026
Search Tags:#code review#authentication#vulnerability#sql injection#xss#owasp#security audit
One-click install
npx skills add https://github.com/HKU-MMLab/UniClawBench --skill security-auditor-hku-mmlab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/HKU-MMLab/UniClawBench/tree/main/injection/101_skill_usage/task_101_10_docker_audit/skills/security-auditor
Command: npx skills add https://github.com/HKU-MMLab/UniClawBench --skill security-auditor-hku-mmlab

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It helps developers systematically find and fix security vulnerabilities in their code—such as SQL injection, XSS, broken access control, and misconfigured security headers—before they reach production. ## Core Features & Use Cases - OWASP Top 10 Audit: Walks through access control, cryptographic failures, injection, XSS, and security misconfiguration with concrete bad/good TypeScript code examples. - Secure Implementation Patterns: Provides ready-to-use patterns for JWT handling, cookie security, rate limiting, Zod input validation, file upload validation, and CSP/security headers in Next.js. - Structured Audit Reports: Outputs findings in a prioritized report format (Critical/High/Medium/Low) with file locations, fixes, and risk descriptions. - Use Case: Before shipping a Next.js API, run a security review to catch missing authorization checks on DELETE endpoints, plaintext password storage, and missing HSTS/CSP headers. ## Quick Start Review my Next.js API routes for OWASP Top 10 vulnerabilities and produce a prioritized security audit report.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my code for OWASP Top 10 vulnerabilities?▼

Run a structured review covering broken access control, cryptographic failures, injection, XSS, and security misconfiguration. The audit checks each endpoint for authentication and authorization, verifies parameterized queries, and outputs findings in a Critical/High/Medium/Low report format.

How to prevent SQL injection in Node.js applications?▼

Use parameterized queries or an ORM instead of string concatenation. For example, pass user input as query parameters like db.query('SELECT * FROM users WHERE email = $1', [email]) rather than interpolating values into the SQL string.

What security headers should a Next.js app have?▼

Configure Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a Content-Security-Policy. These can be set in next.config.js via the headers() function applied to all routes.

Does this work with frameworks other than Next.js?▼

The code examples target TypeScript and Next.js patterns like Server Actions and next.config.js headers, but the OWASP checklist, validation principles, and audit report format apply to any web application stack.

How should JWT tokens be secured in an API?▼

Use short-lived access tokens (around 15 minutes), sign with a secret of at least 256 bits, and validate algorithm, audience, and issuer on every request. Store session tokens in HttpOnly, Secure, SameSite cookies to prevent XSS and CSRF attacks.

Related Skills

Explore More Software Engineering Skills→
Camilo8902Camilo8902

bruno-collection-generator

Generate Bruno API collections from Express, Next.js, and Fastify routes.

Community
Intermediate
nksethnkseth

security-reviewer

Identify security vulnerabilities in code and infrastructure and deliver prioritized audit reports with remediation guidance.

Community
Advanced
arcasilesgrouparcasilesgroup
54

ai-security

Run unified security scans for SAST, DAST, dependencies, and SBOM generation.

Official
Advanced
AnsteorraAnsteorra
6

security-audit

Perform static and dynamic security audits on the KMP application.

Official
Advanced