repo-forensics

Project overview

Use the skill in audit, scan, guide, or harden mode to review a backend project. It detects the stack, maps the attack surface, traces untrusted input to dangerous sinks, checks dependencies and configuration, and reports verified findings with file locations, severity, and fix guidance. Its coverage is anchored to OWASP and ASVS, but it is not runtime testing, a professional penetration test, or a compliance program, and it does not edit code without approval.

Project overview

security-audit guides Claude Code through a defensive review of a codebase, an authorized black-box target, or both. It selects the appropriate checklist for authentication, injection, SSRF, file handling, infrastructure exposure, and rate-limit posture, then emphasizes verification and coordinated disclosure. The runbook assumes explicit permission for external probing and is not a substitute for a funded penetration test or a guide for unauthorized targeting.