Security Audit Web App — Security skill for Claude Code
Use when auditing a web app frontend/edge layer for common security mistakes — server vs client boundary leaks, environment variables exposed to the browser, missing security headers, unsafe redirects.
How to install Security Audit Web App
Installs to ~/.claude/skills/bismillahinspiringquotes-eng-claude-code-kit-security-audit-web-app/SKILL.md
mkdir -p ~/.claude/skills/bismillahinspiringquotes-eng-claude-code-kit-security-audit-web-app && curl -fsSL https://raw.githubusercontent.com/bismillahinspiringquotes-eng/claude-code-kit/HEAD/skills/security-audit-web-app.md -o ~/.claude/skills/bismillahinspiringquotes-eng-claude-code-kit-security-audit-web-app/SKILL.md Restart Claude Code, or start a new session, for it to be picked up.
What Security Audit Web App does
name: security-audit-web-app description: Use when auditing a web app frontend/edge layer for common security mistakes — server vs client boundary leaks, environment variables exposed to the browser, missing security headers, unsafe redirects, dangerous HTML rendering, middleware that can be bypassed. Examples use Next.js + Vercel, but checks apply to any modern web framework (Remix, SvelteKit, Astro, Laravel, Rails).
Security audit — web app layer
You're auditing a web app's fronten
Alternatives in Security
- Security Guidance — Hook that warns about command injection, XSS, and unsafe patterns 14k ★
- Sanyuan Skills — Expert code review skill: SOLID, security, performance, error handling, boundary conditions 2.7k ★
- Portaljs Check Data Quality — Audit a local or remote tabular file (CSV/TSV) for common data quality issues 2.3k ★
Full documentation available on GitHub
View Source RepositoryRelated Skills
Security Audit Database
Use when auditing a database-backed app for the most common database security mistakes — multi-tenant data lea
Skill Auditor Seguranca
Executable security and LGPD gate for AI-built projects. Scans for exposed secrets, .env leaks, Supabase servi
Edge Cases
Act as a rigorous senior Perl SDET. Write a comprehensive set of destructive, pathological, boundary-condition
Security Check
Scan project for security issues — exposed secrets, missing .gitignore entries, unsafe patterns
Security Auditor
Audits code for OWASP-class vulnerabilities — injection, auth flaws, secret leaks, unsafe deserialization.
Review API Contracts
Audit API boundary code for contract drift: response envelope consistency, error response shapes, HTTP status-
Related Agents
React Security
Frontend security reviewer persona for React apps. Use to review XSS risks, secret exposure in client bundles,
Info Disclosure
Information Disclosure specialist (H1 #18, CWE-200/209/215/538/668/798). Use for finding exposed sensitive dat
Kira
Kira — DevOps & Infrastructure Engineer. Owns the deploy pipeline for every project the team runs: Netlify (ne