security-audit
Comprehensive security audit methodology covering OWASP Top 10, dependency scanning, threat modeling, and vulnerability assessment. Provides actionable guidance for conducting systematic security audits from scope definition to final reporting.
Profile →npx skills add cosmicstack-labs/mercury-agent-skills --skill security-audit --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Audit Skill A systematic approach to evaluating the security posture of applications, systems, and infrastructure. This skill equips you with the methodology, tooling, and reporting standards needed to conduct professional-grade security audits. --- ## Core Principles ### 1. **Defense in Depth** Security is not a single control but layered protections. An audit must evaluate each layer independently and in combination. A failure in one layer should be caught by another. ### 2. **Least Privilege** Every component, user, and process should have the minimum permissions necessary to function. Audits must verify that privilege boundaries are enforced, not just declared. ### 3. **Assume Breach** Design and audit with the assumption that an attacker has already compromised some part of the system. What can they access? What can they pivot to? ### 4. **Repeatability** Audit procedures must be reproducible. If two auditors run the same methodology against the same target, they should reach consistent conclusions. ### 5. **Evidence-Based Findings** Every finding must be backed by reproducible evidence — a screenshot, a log entry, a network capture, or a code path. "Trust me" is no
- Core Principles
- 1. Defense in Depth
- 2. Least Privilege
- 3. Assume Breach
- 4. Repeatability
- 5. Evidence-Based Findings
- 6. Continuous Improvement
- Security Audit Maturity Model
- OWASP Top 10 (Current)
- A01: Broken Access Control
- A02: Cryptographic Failures
- A03: Injection
- A04: Insecure Design
- A05: Security Misconfiguration
Subdomain enumeration subfinder -d example.com -o subdomains.txt Port scanning nmap -sV -sC -p- -oA nmap_scan example.com Directory brute-force ffuf -u https://example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt Secret scanning (git repo) gitleaks detect --source=./repo --report=gitleaks-report.json Docker-based automated scan docker run -v $(pwd):/zap/wrk/ -t ghcr.io/zaproxy/zaproxy \
What does the security-audit skill do?
Comprehensive security audit methodology covering OWASP Top 10, dependency scanning, threat modeling, and vulnerability assessment. Provides actionable guidance for conducting systematic security audits from scope definition to final reporting.
How do I install it?
Run `npx skills add cosmicstack-labs/mercury-agent-skills --skill security-audit --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From cosmicstack-labs/mercury-agent-skills, a repository with 364 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.