security-audit

security-audit is a skill for Claude Code, Codex from proffesor-for-testing/agentic-qe. It costs 81 tokens per session (751 once invoked), scanned A, a copy of security-audit, MIT.

A security scanning workflow that checks code for vulnerabilities such as invalid input handling, path traversal, known CVEs, and unsafe coding patterns. A CVE is a publicly catalogued software security flaw.

In plain words
What is it for?
Auditing code, checking input validation, finding path traversal and SQL injection risks, and reviewing security-sensitive features.
Why use it?
Security defects in authentication, APIs, file uploads, database queries, or user-data handling can expose systems to attack. Scanning helps identify these problems during development.

Skill for Claude CodeCodex

Part of the claude-flow plugin — 134 skills, 46 commands, 11 agents, 4 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/proffesor-for-testing/agentic-qe/security-audit
Any agent
npx skills add proffesor-for-testing/agentic-qe --skill security-audit
Clone the repo
git clone --depth 1 https://github.com/proffesor-for-testing/agentic-qe

Made for: Claude Code, Codex.

Or install claude-flow, the plugin that ships this one along with the rest of its 134 skills, 46 commands, 11 agents, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for security-audit

README.md
[![agentmods](https://agentmods.dev/badge/skills/proffesor-for-testing/agentic-qe/security-audit.svg)](https://agentmods.dev/skills/proffesor-for-testing/agentic-qe/security-audit)
Your own site
<a href="https://agentmods.dev/skills/proffesor-for-testing/agentic-qe/security-audit"><img src="https://agentmods.dev/badge/skills/proffesor-for-testing/agentic-qe/security-audit.svg" alt="Measured on agentmods" height="20"></a>
Per session 81 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 751 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00081 $0.00751
Opus 5 $0.00041 $0.00376
Sonnet 5 $0.00016 $0.00150
Haiku 4.5 $0.00008 $0.00075

Measured yesterday against content hash 5337a5c98d88, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to security-audit — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.agents/skills/ruflo/.agents/skills/security-audit/SKILL.md · 136 lines

How it starts

The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Security Audit Skill

Purpose

Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.

When to Trigger

  • authentication implementation
  • authorization logic
  • payment processing
  • user data handling
  • API endpoint creation
  • file upload handling
  • database queries
  • external API integration

When to Skip

  • read-only operations on public data
  • internal development tooling
  • static documentation
  • styling changes

Commands

Full Security Scan

Run comprehensive security analysis on the codebase

npx @claude-flow/cli security scan --depth full

Example:

npx @claude-flow/cli security scan --depth full --output security-report.json

Input Validation Check

Check for input validation issues

npx @claude-flow/cli security scan --check input-validation

Example:

npx @claude-flow/cli security scan --check input-validation --path ./src/api

Path Traversal Check

Check for path traversal vulnerabilities

npx @claude-flow/cli security scan --check path-traversal

SQL Injection Check

Check for SQL injection vulnerabilities

npx @claude-flow/cli security scan --check sql-injection

XSS Check

Check for cross-site scripting vulnerabilities

npx @claude-flow/cli security scan --check xss

CVE Scan

Scan dependencies for known CVEs

npx @claude-flow/cli security cve --scan

Example:

npx @claude-flow/cli security cve --scan --severity high

Security Audit Report

Generate full security audit report

npx @claude-flow/cli security audit --report

Example:

npx @claude-flow/cli security audit --report --format markdown --output SECURITY.md

Threat Modeling

Run threat modeling analysis

npx @claude-flow/cli security threats --analyze

Validate Secrets

Check for hardcoded secrets

Read the full file on GitHub · 136 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 136 lines · 81 tokens per session scan A 5337a5c98d88

Subscribe to this mod's changes

security-audit is a skill published in the GitHub repository proffesor-for-testing/agentic-qe (473 stars, last pushed 3d ago), licensed MIT. It adds 81 tokens to every session and 751 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to security-audit, differing in 0 lines, and is treated as a copy.

Related

Other skills, from other repositories

foundry-config-setup

Resolve missing setup caused by a hardcoded Foundry project endpoint or model in a sample. Use when a sample fails because it uses a placeholder/hardcoded projectendpoint (for example "https://your-project.services.ai.azure.com") or a hardcoded model instead of reading them from the environment.

microsoft/agent-framework · 65 tokens

dogfood

Systematically explore and test a mobile app on iOS/Android with agent-device to find bugs, UX issues, and other problems. Use when asked to dogfood, QA, exploratory test, find issues, bug hunt, or test this app on mobile.

callstack/agent-device · 55 tokens

tooluniverse-drug-research

Comprehensive drug profiling — mechanism, primary/secondary targets, drug interactions, clinical-trial status, adverse events (FAERS), pharmacogenomics, and approval history. Use for full drug investigation reports, 'tell me about drug X' queries, and assembling drug profiles for clinicians, researchers, or regulatory…

mims-harvard/ToolUniverse · 71 tokens

harness-diet

Measure and shrink the always-loaded context of a Claude Code harness (CLAUDE.md + rules without paths frontmatter) back under budget — migrate narrative to reference files, convert rules to path-scoped or skill-triggered loading, and verify zero governance loss with deterministic preservation checks. Use on "harness…

sangrokjung/claude-forge · 140 tokens

monorepo-management

Master monorepo management with Turborepo, Nx, and pnpm workspaces to build efficient, scalable multi-package repositories with optimized builds and dependency management. Use when setting up monorepos, optimizing builds, or managing shared dependencies.

wshobson/agents · 54 tokens

gh-bulk-issues

Orchestrate parallel Mastra Code headless instances to debug and fix multiple GitHub issues simultaneously.

mastra-ai/mastra · 25 tokens