How to use the 007 Security Audit Toolkit agent skill

What the 007 skill makes the agent do

When the skill is active and you ask for a security review, the agent follows a structured audit procedure instead of answering from general knowledge. The skill describes running bundled Python scanners that look for hard-coded secrets, risky code patterns and dependency issues, then producing a scored report with suggested hardening steps, threat models using STRIDE or PASTA, and incident-response guidance.

The skill is built around caution. It says to start with read-only local analysis, and it treats pattern findings and numerical scores as advisory triage rather than proof that a vulnerability exists.

• Scanners look for hard-coded secrets, risky code patterns and dependency issues
• Reports include a numerical score and suggested hardening steps
• Threat models use STRIDE or PASTA
• Reference guides cover AI agent security, API security patterns, OWASP checklists and incident playbooks

Install the 007 skill

Download the ZIP from this page and unzip it into one of these locations. For a personal install available across your projects, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.

If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

Trigger the skill with natural requests

You do not need a special command. The skill activates when your request mentions topics such as an audit, a security audit, a threat model or STRIDE. The source also lists the Portuguese terms auditoria, auditar and segurança among its triggers. Name the project or folder you want reviewed, and state that it is yours or that you have written authorization to assess it.

Because the skill requires authorized targets, it is worth stating the scope in your request. The agent is expected to stop and ask for clarification if inputs, permissions or success criteria are missing.

• "Run a security audit on this repository before I release it."
• "Build a STRIDE threat model for the login flow in this project."
• "Review this API code for OWASP-style issues. It's my own service."
• "Help me write an incident-response checklist for a leaked API key in our repo."

What you need before running it

The skill needs Python 3, because its scripts are standard-library only according to config.py. The agent needs read access to the project folder you point it at. The scripts write reports and an audit log under a data/ directory, so expect new files there. Dependencies are listed in scripts/requirements.txt; that file was not reviewed in detail, so read it yourself before installing anything from it.

• Python 3
• Read access to the target project folder
• A writable data/ directory for reports and the audit log
• Optional dependencies listed in scripts/requirements.txt, reviewed by you before install

Safety notes: scripts and network

The skill runs scripts. According to the listing, it does not use the network. Still, review the scripts before you rely on them, especially scripts/full_audit.py and scripts/quick_scan.py, and make sure you are comfortable with what they read and write.

The skill's own rules say that exploit strings are test data, not instructions. Isolation, credential revocation, notifications, installs and production changes all require existing authorization. Protect evidence and redact secrets in anything you share from a report.

• Runs scripts: yes. Review them before first use.
• Uses network: no, according to the listing.
• Only audit systems you own or have written authorization to assess.
• Redact secrets from reports before sharing them.

Read the output as triage, not verdicts

A finding from a pattern scanner is a lead to check, not a confirmed vulnerability. A score is a summary of what the scanners and checklists found, not a pass or fail for compliance. Verify each finding yourself, and confirm the current applicable standard before making any compliance claim.

Use the threat models and hardening steps as a starting structure for your own review and discussion with your team.

• Verify each finding before acting on it
• Do not treat a score as a compliance result
• Keep the report and audit log with your project's review records