Claude Code Security Audit Skill — Security skill for Claude Code
A comprehensive, full-stack security audit skill for Claude Code.
How to install Claude Code Security Audit Skill
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open toshipon/claude-code-security-audit-skill and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Claude Code Security Audit Skill does
A comprehensive, full-stack security audit skill for Claude Code. Run /security-audit all and get an end-to-end vulnerability assessment across your entire stack.
Alternatives in Security
- Skills — Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows 4k ★
- Tech Debt Skill — Claude Code skill that produces a thorough, file-cited tech debt audit of an entire codebase 590 ★
- Raptor Loop Hunt — RAPTOR autonomous looping multi-altitude security vulnerability hunt — Claude Code skill 212 ★
README
Claude Code Security Audit Skill
A comprehensive, full-stack security audit skill for [Claude Code](https://claude.ai/code). Run `/security-audit all` and get an end-to-end vulnerability assessment across your entire stack.
Supported Stack
| Layer | Technology | Standard |
|---|---|---|
| Web Application | Next.js (App Router, Server Actions, Middleware) | OWASP Top 10:2025, WSTG |
| Infrastructure | Vercel, Terraform, AWS, GCP, Azure | Vercel Best Practices, CIS Benchmarks |
| Backend (BaaS) | Supabase (RLS, Auth, Storage, Edge Functions) | Supabase Hardening Guide |
| Backend (Python) | Django, FastAPI, Flask | OWASP + Bandit |
| Backend (Go) | Standard library, Gin, Echo | OWASP + govulncheck |
| Backend (Ruby) | Ruby on Rails | OWASP + Brakeman |
| Backend (Rust) | Actix-web, Axum, Rocket | cargo-audit, unsafe analysis |
| Mobile (iOS) | Swift, UIKit/SwiftUI | OWASP MASVS v2 / MASTG |
| Mobile (Android) | Kotlin, Java | OWASP MASVS v2 / MASTG |
| Mobile (Flutter) | Dart | MASVS + Flutter security patterns |
| Mobile (React Native) | JavaScript/TypeScript | MASVS + RN security patterns |
| Compliance | PCI-DSS, HIPAA, SOX, GDPR, CCPA, SOC2, ISO27001 | Regulatory standards |
| Advanced | Supply Chain, Container/K8s, CI/CD, Secrets, LLM/AI | OWASP Top 10 for LLM, CIS |
| General Web | Any web framework | OWASP WSTG |
Quick Start
Option 1: Plugin Marketplace (recommended)
Inside Claude Code:
/plugin marketplace add toshipon/claude-code-security-audit-skill
/plugin install security-audit@toshipon-security-auditThe same thing from a shell:
claude plugin marketplace add toshipon/claude-code-security-audit-skill
claude plugin install security-audit@toshipon-security-auditThe marketplace is named `toshipon-security-audit` (distinct from the companion [security-assessment](https://github.com/toshipon/claude-code-security-assessment-skill) marketplace `tos
Related Skills
Claude Security Research Skill
AI-powered security research assistant for Claude Code — structured assessment workflows, tool orchestration,
Audit Software
Audit software inventory across devices using ZDX data for compliance and vulnerability assessment.
Multi Tenant Fullstack Crud Skill
A full-stack CRUD Agent Skill for building production-ready multi-tenant web apps with role-based access, audi
Strategy Review
Run a full strategic review — competitive positioning, 7 Powers moat assessment, strategy stack audit, and pre
Therion System
The Mindset Your AI Is Missing Like hiring an entire team. Except it's free. 67 specialists across 12 professi
Cso
Chief Security Officer review — vulnerability assessment, auth patterns, secret management, dependency risks
Related Agents
Atlas
You are a specialized E2E testing agent. Your job is to run end-to-end tests, browser automation, and full-sta
Duplication Hunter
Hunts code duplication, redundant utilities, and parallel implementations across an entire codebase. Use when
Creo Perf Audit
Full-stack performance auditor across six layers (database, API shape, edge proxy, client data layer, renderin
