Code and Infrastructure Security Audit
Get evidence-backed security findings for code, cloud configuration, dependencies, and secrets, with ranked fixes and tests.
Before & after
Same prompt, same agent — the only difference is the skill.
I can help review your code for security issues. There are many potential vulnerabilities to look for — things like SQL injection, cross-site scripting, insecure dependencies, hardcoded secrets, and more. The audit will depend on your tech stack, deployment model, and what data you're handling. I'd recommend checking your dependencies, reviewing authentication logic, and making sure secrets aren't in version control. Would you like me to focus on any particular area, or should I do a general review?
SECURITY AUDIT REPORT DEPENDENCY SCAN Package vulnerabilities found: 3 • lodash-4.17.19 → CRITICAL (Prototype Pollution) → Upgrade to 4.17.21+ • express-session-1.16.0 → HIGH (Session Fixation) → Upgrade to 1.17.3+ • debug-3.1.0 → MEDIUM (Regular Expression DoS) → Upgrade to 4.3.1+ CRYPTO & AUTH • Password hashing: bcrypt rounds=10 (PASS) • JWT secret in .env (PASS - not in code) • Session store using memory — FAIL: Move to Redis with 24h expiry • No CSRF token on state-changing endpoints (POST/PUT) — FAIL: Add token middleware API & INJECTION • SQL queries: using parameterized statements (PASS) • File upload: no extension whitelist (FAIL): Add .jpg, .png, .pdf only • API rate limit: none detected (FAIL): Add token bucket at 100 req/min per IP INFRASTRUCTURE • Secrets in environment: PASS • CORS: wildcard origin detected (FAIL): Restrict to known domains only • HTTP headers: Missing X-Content-Type-Options, CSP (FAIL): Add security headers middleware REMEDIATION PRIORITY 1. Add CSRF middleware (1 hour) 2. Restrict CORS origins (30 min) 3. Upgrade dependencies (2 hours including test) 4. Migrate sessions to Redis (4 hours) 5. Implement rate limiting (2 hours) Note: This is a structural audit, not a penetration test. Engage a professional security team for sensitive systems.
About this skill
“The scanner found 80 issues. Which ones can actually hurt us?” This skill traces attacker-controlled input, checks authorization boundaries, and inspects effective infrastructure permissions to separate supported vulnerabilities from speculative warnings. You get a prioritized repair plan tied to specific code or resources.
What it does
- Traces entry points through validation, authorization, and dangerous operations to establish plausible attack paths.
- Checks tenant isolation, object access, privilege changes, session handling, and sensitive data exposure.
- Reviews cloud configurations for effective public access, excessive permissions, and paths to sensitive resources.
- Validates dependency alerts against resolved versions and advisory conditions, while separating confirmed matches from unverified claims.
- Handles suspected credentials without exposing them and distinguishes containment from permanent repair.
- Assigns severity and confidence separately, then supplies concrete fixes and regression checks.
What you get
A scoped security audit with evidence-backed findings, affected locations, exploit prerequisites, impact, and remediation ordered by urgency. Each finding includes a verification step; the report states what was inspected, what remains unknown, and which tests were actually performed.
Best for
Developers reviewing a release or pull request, maintainers triaging scanner results, and platform teams checking infrastructure changes before deployment.
SKILL.md preview
---
name: code-and-infrastructure-security-audit
description: >-
Audit code, infrastructure, dependencies, and suspected secrets by tracing attack paths, checking trust boundaries, and validating evidence. Produce prioritized findings with severity, confidence, concrete repairs, and regression checks. Use when the user says "audit this API before release", "review this PR for security", "can users access another tenant's data?", "my scanner keeps flagging everything", "check these cloud permissions", "are these dependency alerts exploitable?", or "I think we committed a secret".
---
# Code and Infrastructure Security Audit
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.