My Security Auditor
Comprehensive authorized security audit skill covering web, APIs, cloud, Kubernetes, mobile, AI/LLM, microservices, SaaS (multi-tenancy, SSO, BYOK), plus red/blue/purple team operations. Integrates OWASP (Top 10, API/Mobile/LLM/Cloud/K8s, ASVS, SAMM, WSTG, MASVS), MITRE ATT&CK + D3FEND, OSSTMM with RAV, NIST RMF/CSF, FAIR, ISO 27001 family, CVSS/EPSS/SSVC, Zero Trust (800-207, CISA ZTMM), SABSA, CIS, CSA CCM, SOC 1/2/3, PCI-DSS v4.0.1, GDPR/LGPD/CCPA/HIPAA privacy, customer trust deliverables (DPAs, CAIQ/SIG, VDPs), SOC operations, detection engineering, threat hunting, adversary emulation (CA
Install
npx skills add leomarviegas/my-security-auditor --skill my-security-auditorgit clone --depth 1 https://github.com/leomarviegas/my-security-auditor.git /tmp/my-security-auditor
mkdir -p ~/.claude/skills
cp -r /tmp/my-security-auditor/. ~/.claude/skills/my-security-auditorPersonal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.
From the SKILL.md
# Security Auditor A structured, authorized, attacker-minded security assessment skill for web applications, APIs, cloud infrastructure, Kubernetes, and microservices. Combines browser-driven crawling, OWASP-style testing, bug-bounty-grade recon, multi-framework compliance mapping, and multi-model review into a single workflow that produces engineer-usable, triage-ready reports. ## Before You Start Read the relevant reference files based on the phase you're entering: ### Core workflow references | Phase | Reference file | |-------|---------------| | Planning & scope | This file (you're here) | | OWASP testing | `references/owasp-checks.md` | | Recon & triage | `references/recon-playbook.md` | | Attack chain analysis | `references/attack-chains.md` | | Report writing | `references/report-template.md` | | Multi-model review | `references/multi-model-review.md` | ### Framework references (read based on target characteristics) | Target characteristic | Reference file | |----------------------|---------------| | Any web app / API | `references/frameworks/owasp-complete.md` — All OWASP frameworks (Top 10, API Top 10, Mobile Top 10, LLM Top 10, Cloud-Native Top 10, K8s Top 10, ASVS, SAMM, WSTG, threat modeling, cheat sheets) |
Details
- Skill name
my-security-auditor- Repository
- leomarviegas/my-security-auditor
- License
- Apache-2.0
- Repo updated
- 7 May 2026
FAQ
What does the My Security Auditor skill do?
Comprehensive authorized security audit skill covering web, APIs, cloud, Kubernetes, mobile, AI/LLM, microservices, SaaS (multi-tenancy, SSO, BYOK), plus red/blue/purple team operations. Integrates OWASP (Top 10, API/Mobile/LLM/Cloud/K8s, ASVS, SAMM, WSTG, MASVS), MITRE ATT&CK + D3FEND, OSSTMM with RAV, NIST RMF/CSF, FAIR, ISO 27001 family, CVSS/EPSS/SSVC, Zero Trust (800-207, CISA ZTMM), SABSA, CIS, CSA CCM, SOC 1/2/3, PCI-DSS v4.0.1, GDPR/LGPD/CCPA/HIPAA privacy, customer trust deliverables (DPAs, CAIQ/SIG, VDPs), SOC operations, detection engineering, threat hunting, adversary emulation (CA
How do I install the My Security Auditor skill?
skills CLI (Claude Code, Cursor, Codex and more): npx skills add leomarviegas/my-security-auditor --skill my-security-auditor. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Is My Security Auditor popular?
It lives in leomarviegas/my-security-auditor, which has 10 GitHub stars and 1 forks.
Related skills
Repo Seed
10EricSanchezok/repo-seed
Seed, audit, adopt, and progressively evolve an agent-native repository with risk-triggered specs, durable decisions, resident governance skills, capability state, deterministic gates, and safe upgrades. Use when initializing or upgrading a repository, when an unmanaged repository grows complex, or when delivery, ownership, security, release, or incident signals suggest a governance capability is missing.
Security Bluebook Builder
8SHADOWPR0/security-bluebook-builder
Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps handling PII/PHI/financial data.
SAAS Security
11vitormiziara/saas-security
Comprehensive SaaS security skill covering code auditing, checklist generation, and vulnerability reporting. TRIGGER this skill whenever the user asks to: audit code for security issues, review a codebase for vulnerabilities, generate a security checklist, check for OWASP compliance, review authentication or authorization logic, check for injection risks, race conditions, or insecure configurations, or asks anything related to SaaS security hardening. Also trigger proactively when the user shares code and asks for a review — always include a security perspective using this skill.
Malware Analysis Static
12guelfoweb/malware-analysis-static
Use this skill for static malware analysis and reverse engineering of suspicious binaries, Android APKs, Office documents, web payloads, scripts, source-code droppers, and multi-stage chains across Linux, macOS, and Windows. It guides Codex through safe lab workflow, tool discovery with per-install authorization, triage, staged payload retrieval when authorized, decoding, evidence preservation, AGENTS.md memory, REPORT.md reporting, C2/drop URL extraction, and family attribution.
Skill Security Reviewer
9oguzhantopgul/skill-security-reviewer
Security review and threat analysis for agent skills. Use when reviewing, auditing, or validating skills for security issues including prompt injection, code execution risks, data exfiltration, supply chain vulnerabilities, and policy violations. Triggers on requests to "review a skill", "audit skill security", "check skill for vulnerabilities", "validate skill safety", or any security assessment of SKILL.md files and their associated scripts/assets.
Security Scan
20Ray0907/security-scan
Use when a user asks to scan a repository for dependency vulnerabilities, license compliance, insecure code patterns, CVEs, or OWASP Top 10 risks.
Browse the most popular Claude skills, all security skills, or write your own with the skills generator.