What is security-audit?

A review of whether software and its surrounding systems are protected against misuse and attack. It can examine a design before coding or inspect code, infrastructure, dependencies, and secrets for security problems.

Use it for threat modeling, authentication and authorization design, data classification, vulnerability checks, dependency reviews, and security checks before release.

It helps find weaknesses such as unsafe authentication, exposed secrets, vulnerable dependencies, or common web application flaws before they cause harm.

security-audit — Skill for Claude Code by karsten-s-nielsen

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add karsten-s-nielsen/mad-scientist-skills --skill security-audit

Clone the repo

git clone --depth 1 https://github.com/karsten-s-nielsen/mad-scientist-skills

Made for: Claude Code.

Or install mad-scientist-skills, the plugin that ships this one along with the rest of its 11 skills, 4 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/karsten-s-nielsen/mad-scientist-skills/security-audit/github.svg)](https://agentmods.dev/skills/karsten-s-nielsen/mad-scientist-skills/security-audit)

Your own site

<a href="https://agentmods.dev/skills/karsten-s-nielsen/mad-scientist-skills/security-audit"><img src="https://agentmods.dev/badge/skills/karsten-s-nielsen/mad-scientist-skills/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/karsten-s-nielsen/mad-scientist-skills/security-audit"><img src="https://agentmods.dev/badge/skills/karsten-s-nielsen/mad-scientist-skills/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 167 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 13,708 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00167	$0.13708
Opus 5.5	$0.00067	$0.05483
Sonnet 5.5	$0.00033	$0.02742
Haiku 4.5	$0.00017	$0.01371

Measured 2mo ago against content hash ff87316d9d2e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

security-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

plugins/mad-scientist-skills/skills/security-audit/SKILL.md · 889 lines

How it starts

The opening of the file, as written. The whole thing — 889 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Security Audit

A comprehensive security skill with two modes and two tiers:

Modes:

Planning (before code exists) — threat modeling, auth design, data classification
Audit (on existing code) — vulnerability scanning, infrastructure review, dependency audit

Tiers (applied within each phase):

Standard — free tools, code-level patterns, open-source scanners. Always actionable for any developer.
Enterprise — paid services (WAF, SIEM, DAST/SAST), compliance tooling. Serves as a professional checklist documenting what enterprise teams should implement.

Core question: "Is this system defensible?"

When to use this skill

When the user says "security audit", "threat model", "check for vulnerabilities", "review security", or "harden this"
Before designing a new system (planning mode) — to identify threats early
On an existing codebase (audit mode) — to find and fix vulnerabilities
Before a production deployment — to validate security posture
After adding authentication, authorization, or data handling features

Mode detection

Determine which mode to operate in based on the project state:

Signal	Mode	Rationale
User says "threat model", "security plan", "design review"	Planning	Architecture-level analysis before code
User says "audit", "scan", "check for vulnerabilities"	Audit	Code and infrastructure scanning
No source code exists yet (only docs, diagrams, RFCs)	Planning	Nothing to scan — model threats instead
Source code and/or IaC files exist	Audit	Concrete artifacts to analyze
Both code and a request to "threat model"	Both	Run planning phases on architecture, audit phases on code

When in doubt, ask the user. If both modes apply, run all 14 phases.

Severity classification

Every finding must be assigned a severity:

Severity	Criteria	Action	SLA
Critical	Actively exploitable, data breach risk, auth bypass, RCE	Fix immediately	Block release
High	Significant risk but requires specific conditions (SSRF, SQL injection, privilege escalation)	Fix before next release	1 sprint
Medium	Defense-in-depth gaps, missing headers, verbose errors, weak crypto	Schedule fix	2 sprints
Low	Informational, best practice deviations, minor hardening opportunities	Track in backlog	Best effort

Read the full file on GitHub · 889 lines

Files

What ships with it

6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 889 lines · 167 tokens per session scan A ff87316d9d2e

Subscribe to this mod's changes

security-audit is a skill published in the GitHub repository karsten-s-nielsen/mad-scientist-skills (3 stars, last pushed 1mo ago), licensed MIT. It adds 167 tokens to every session and 13,708 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Security architecture c4-model claude-code-plugin code-quality observability

security-audit next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
security-auditkarsten-s-nielsen/mad-scientist-skills	Skill	3	1mo ago	MIT	A	167	Claude Code
mapjlifyio/wyx	Skill	3	29d ago	MIT	A	60	Claude Code
conceptjlifyio/wyx	Skill	3	29d ago	MIT	A	73	Claude Code
auditjlifyio/wyx	Skill	3	29d ago	MIT	A	81	Claude Code
pipelinejlifyio/wyx	Skill	3	29d ago	MIT	A	66	Claude Code
syncjlifyio/wyx	Skill	3	29d ago	MIT	A	58	Claude Code
refactorzircote-plugins/refactor	Skill	2	5mo ago	MIT	A	112	Claude Code

security-audit