How to use the Security Audit and Code Review agent skill

What the security-audit skill makes the agent do

An agent skill is a folder containing instructions that an AI agent reads to change how it approaches a task. This skill is a single file, SKILL.md. It tells the agent to act as a senior application security engineer who identifies flaws using the OWASP framework, analyses CVE reports for impact, and recommends practical fixes.

The guidance covers six areas: SAST tools in CI, DAST scanning of staging environments, dependency scanning, authentication review, STRIDE threat modelling for new features, and checking authorization for IDOR. It also lists common patterns such as parameterized queries and Content Security Policy, and pitfalls such as client-side-only validation, logging sensitive data, using MD5 or SHA-1 for passwords, and exposing stack traces to users.

Install the security-audit skill

Download the ZIP for the skill from this page. Unzip it into one of these locations:

You can install it for yourself across projects by unzipping into ~/.claude/skills/. You can also install it for a single project by unzipping into that project's .claude/skills/ folder.

In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project only: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload

Trigger the skill with natural requests

You do not need a special command. Describe the security task in plain language and mention what you want reviewed. The agent uses the skill when the request matches its description: security audit, OWASP, CVE analysis, code review, or penetration testing methodology.

Be specific about the scope. A request that names a file, endpoint, or pull request gives the agent something concrete to check.

• Review this pull request for common web security mistakes, especially authorization.
• Check this endpoint for IDOR. Does every query verify the logged-in user owns the record?
• Suggest a STRIDE threat model for the new file upload feature.
• Look at how this code hashes passwords and tell me if it is acceptable.
• Which SAST and dependency scanning tools should our CI run for a Node.js service?

What kinds of findings to expect

Because the skill is a set of guidelines, the agent reasons about your code and designs against them. Typical findings include injection risks from string-built SQL, broken authorization where ownership is not checked, weak password hashing, and error responses that expose internal details. For each, the agent can suggest a fix.

The skill recommends external tools such as Semgrep, CodeQL, Bandit, OWASP ZAP, Burp Suite, npm audit, cargo audit, pip-audit and Snyk. It does not run them. You run those tools yourself, and the skill can help you decide what to configure and how to read the results.

Safety and what the skill does not do

The skill declares no required dependencies. It does not run scripts and does not use the network. Its own files only contain text guidance, so installing it does not add scanners or execute code on your machine.

Its findings are general methodology, not a certified penetration test or compliance sign-off. Verify important findings with a qualified security professional. The file frames itself around defence, but its attacker-style language is meant for securing your own systems. Do not use it against systems you do not own.