About

Imported from vladm3105/aidoc-flow-framework (platforms/claude-code-plugin/skills/security-audit/SKILL.md). Install upstream with npx skills add vladm3105/aidoc-flow-framework --skill security-audit. Copyright stays with the author.

security-audit

Name: security-audit
Author: vladm3105

Purpose

Ensure security requirements are properly defined, implemented, and tested, and identify vulnerabilities across code, dependencies, infrastructure, and configuration. Validates compliance against recognized standards (OWASP Top 10, CWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat modeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR security topics upstream of it.

When to Use

Use security-audit when:

Reviewing the security posture of an SDD project or its implementation.
Validating that security requirements in SPEC (and upstream EARS/ADR) are complete and testable.
Scanning code, dependencies, infrastructure, or configuration for vulnerabilities, secrets, or compliance gaps.
Performing threat modeling on a component or system.

Do not use it for general (non-security) artifact quality (use ../quality-advisor/SKILL.md) or traceability validation (use ../doc-validator/SKILL.md).

Behavior

The audit runs as a pipeline, producing a single report:

Requirements validation — check security requirements (sourced from SPEC and upstream EARS/ADR) for completeness: authn/authz, data protection, encryption, key management; flag missing or vague requirements.
Code scanning — SAST (bandit, semgrep), dependency CVEs (safety, pip-audit), secret detection (detect-secrets, gitleaks), and pattern checks for injection, XSS, and CSRF. Critical findings block deployment.
Infrastructure scanning — IaC (checkov, tfsec), containers (trivy, grype), Kubernetes, and cloud/network configuration.
Dependency assessment — known CVEs, CVSS scoring, outdated and transitive packages, and license-compliance issues.
Compliance check — OWASP Top 10 (2021) coverage and CWE mapping, plus any applicable regulatory frameworks.
Threat modeling — STRIDE analysis, attack-surface and trust-boundary mapping, with mitigation status per threat.
Report — overall security score, findings grouped by severity (critical/high/medium/low) with file:line, CWE/CVE, CVSS, and fix, plus compliance status and prioritized remediation. Critical issues are marked as deployment blockers.

Targets: zero critical vulnerabilities, no secrets in the repository, 100% coverage of MUST security requirements, OWASP Top 10 fully covered.

Limitations: cannot detect all business-logic flaws, may produce false positives requiring manual review, and depends on current tool vulnerability databases.

Related Resources

SPEC layer: ${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/README.md · ${CLAUDE_PLUGIN_ROOT}/framework/layers/06_SPEC/SPEC-TEMPLATE.yaml
Upstream security topics: ${CLAUDE_PLUGIN_ROOT}/framework/layers/03_EARS/README.md · ${CLAUDE_PLUGIN_ROOT}/framework/layers/05_ADR/README.md
Governance: ${CLAUDE_PLUGIN_ROOT}/framework/governance/ (ID, tagging, traceability standards)
Related skills: ../quality-advisor/SKILL.md · ../doc-validator/SKILL.md · ../doc-spec/SKILL.md
References: OWASP Top 10 (2021), CWE, OWASP ASVS

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/vladm3105-aidoc-flow-framework-security-audit/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

vladm3105-aidoc-flow-framework-security-audit.ocm.jsonjson

{
  "ocm": "1",
  "id": "vladm3105-aidoc-flow-framework-security-audit",
  "kind": "skill",
  "name": "security-audit",
  "description": "Validate security requirements and assess vulnerabilities across code, dependencies, infrastructure, and configuration, with OWASP/CWE compliance and STRIDE threat modeling. Use to security-review an SDD project or its implementation.",
  "publisher": "vladm3105",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding",
      "legal"
    ],
    "tags": [
      "skill-md",
      "sdd-workflow",
      "utility",
      "quality-assurance",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Validate security requirements and assess vulnerabilities across code, dependencies, infrastructure, and configuration, with OWASP/CWE compliance and STRIDE threat modeling. Use to security-review an SDD project or its implementation."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/vladm3105/aidoc-flow-framework",
      "path": "platforms/claude-code-plugin/skills/security-audit/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/vladm3105/aidoc-flow-framework/blob/HEAD/platforms/claude-code-plugin/skills/security-audit/SKILL.md",
      "key": "vladm3105/aidoc-flow-framework/platforms/claude-code-plugin/skills/security-audit/SKILL.md"
    }
  },
  "instructions": "# security-audit\n\n## Purpose\n\nEnsure security requirements are properly defined, implemented, and tested, and\nidentify vulnerabilities across code, dependencies, infrastructure, and\nconfiguration. Validates compliance against recognized standards (OWASP Top 10,\nCWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat\nmodeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR\nsecurity topics upstream of it.\n\n## When to Use\n\nUse `security-audit` when:\n\n- Reviewing the security posture of an SDD project or its implementation.\n- Validating that security requirements",
  "cost": {
    "context_tokens": 783
  }
}

Fetch it by URL: GET /api/v1/registry/vladm3105-aidoc-flow-framework-security-audit/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.