Deep Security Audit

Deep, multi-agent security audit of a codebase — WordPress plugin, Laravel, Next.js, Node/Express, Django/Rails, or any app. Detects the framework, maps the REAL attack surface (routes, handlers, auth, sinks), then fans out scoped finder agents that READ and understand the code (not just grep), adversarially verifies every finding (proves the guard is genuinely absent + traces reachability), scores honest CVSS 3.1, dedupes, and produces a ranked report. Use whenever the user asks to find security issues / vulnerabilities, run a security audit or pentest, "is this secure", "scan this plugin/app

3 starsSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add ravindrakele/claude-skills --skill deep-security-audit

Manual install

git clone --depth 1 https://github.com/ravindrakele/claude-skills.git /tmp/claude-skills
mkdir -p ~/.claude/skills
cp -r /tmp/claude-skills/plugins/deep-security-audit/skills/deep-security-audit ~/.claude/skills/deep-security-audit

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Deep Security Audit

A repeatable, multi-agent pipeline that finds real, exploitable security bugs by
**understanding code**, not pattern-matching. It fans work out to scoped finder
agents, then makes a second wave of agents **try to refute** each finding before
it's reported — so what survives is high-signal.

## Operating rules (non-negotiable)

1. **READ-ONLY.** Static analysis of source only. Never edit/commit/push. Never
   run an exploit against a live/hosted system. Local, self-owned, non-destructive
   PoCs only — and only if the user explicitly asks to verify one.
2. **Understand, don't grep.** grep is for *locating* the surface. Every finding
   must come from an agent that read the handler, its callers, its
   auth/middleware/validation, and traced reachability. No finding from a raw
   grep hit alone.
3. **Prove the guard is ABSENT.** A missing check is only a finding if you
   verified the framework's normal guard (nonce, capability, policy,
   `permission_callback`, auth middleware, `prepare()`, escaping, validation)
   is genuinely not there on that path. Frameworks have defaults — check them.
4. **Honest CVSS, no inflation.** Score CVSS 3.1 by real preconditions. If a
   BOLA needs an unguessable UUID → `AC:H`. If exploitation needs auth → `PR:L/H`.
   State the precondition. Downgrade the moment evidence contradicts the ceiling.
5. **Empirically calibrate when possible.** If a "read-back / exfil" claim can be

Read the full skill on GitHub

Details

Skill name: deep-security-audit
Repository: ravindrakele/claude-skills
Path: plugins/deep-security-audit/skills/deep-security-audit/SKILL.md
License: MIT
Repo updated: 29 July 2026
Listed in: karanb192/awesome-claude-skills

FAQ

What does the Deep Security Audit skill do?

How do I install the Deep Security Audit skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add ravindrakele/claude-skills --skill deep-security-audit. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Deep Security Audit popular?

It lives in ravindrakele/claude-skills, which has 3 GitHub stars and 0 forks, and is included in 1 curated skill list.

Related skills

Deep Security Check

give-jd/deep-security-check

Use when the user asks for a defensive security assessment, security audit, vulnerability scan, or "how safe / how reliable is this code/project/repo". Runs Semgrep (SAST), osv-scanner (dependency CVEs) and gitleaks (secrets) against a local project, then produces a report with a reproducible reliability grade (0-100, A-F). Defensive only — finds weaknesses in code you own; it does not exploit, attack, or test remote targets.

SecurityIn 1 list

Web Security Reviewer

goingli0324/web-security-reviewer

對使用者自己的程式碼做防禦性安全審查，檢測資安漏洞、資料外洩風險、壓力／效能風險與程式品質，並產出「依嚴重度排序的風險報告＋修正後程式碼」。涵蓋 Google Apps Script（Workspace 自動化）、前端 HTML/CSS/JS、後端 API（Node/Python/PHP 等）。特別適用於「使用者用 AI 生成 / vibe coding 寫出來、希望更安全、避免被攻擊或破壞」的網頁程式碼。MANDATORY TRIGGERS：使用者要求「檢測程式碼安全」「幫我看這段 code 有沒有漏洞」「防止資料外洩」「review 我的網頁／後端程式」「這段會不會被攻擊／被駭」「加固 / harden」「壓力測試」「優化程式碼安全性」「個資會不會外洩」「這是 AI 寫的幫我看安不安全」，或貼上一段前端／後端／Apps Script 程式碼並要求審查、找漏洞、修正建議、加固時，都要套用此 skill。即使使用者沒明說「資安」，只要意圖是審查或加固自己的程式碼，就觸發。SCOPE：本 skill 僅用於防禦性檢測——找出並修補使用者自己程式碼裡的漏洞；不協助撰寫可直接攻擊用的 exploit、不協助繞過資安機制。本 skill 同時是 agentic-dev-loop「Verify 雙閘」的安全閘：當該編排器要在部署前驗證安全／個資時會呼叫本 skill；使用者單獨要求安全審

Security

Incident Reporting Navigator

Ansvar-Systems/incident-reporting-navigator-skill

Use when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one incident across the EU reporting regimes — NIS2, GDPR, DORA, and the Cyber Resilience Act — determines which duties fire for each involved entity's roles, resolves the receiving authority per regime and member state from served national law, and produces a deadline table in which every duty, authority, and deadline is cited from official publisher text fetched live through the Ansvar Gateway MCP connector. Never answers from model memory.

SecurityIn 1 list

Tenable Sc Reporting Assistant

hamzhk15/tenable-sc-reporting-assistant

Generate importable Tenable Security Center (Tenable SC / SecurityCenter) XML for dashboards, PDF reports, and CSV exports, then optionally upload them to a SC console via API keys. Works two ways — a freeform mode that maps any dashboard/report a user describes to a catalog of known-good components, proposes the layout for approval, and builds it with tested builders; and a curated "Vulnerability Management and Remediation Planning" dashboard/report as a ready-made starting point. Use whenever someone wants to build, customize, or deploy a Tenable SC dashboard or report of any kind — vulnerab

Security

Regulatory Threat Model

Ansvar-Systems/regulatory-threat-model-skill

Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MCP connector and grounds every regulatory statement in officially published text fetched at answer ti

SecurityIn 1 list

Ia Security Skill

antoniocostalopes/ia-security-skill

Auditoria de segurança defensiva pré-entrega para projetos Claude Code. Cobre web, mobile (MASVS), cloud/IaC, web3 e ML/AI em 18 linguagens e 34 frameworks. Devolve relatório Markdown com score 0-100, mapa de postura (seguro/menos seguro/inseguro por área), attack chains e achados detalhados; opcionalmente aplica as correções no código com confirmação por achado. Ativa quando o developer pede para auditar, fazer security review, verificar vulnerabilidades, corrigir/blindar código antes do deploy.

Security

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.