Security Audit Skill plugin
A security audit skill built on OWASP Top 10, CWE and CVSS, with deep PHP and TYPO3 scanning across 80-plus checkpoints.
- 52 ★ on the repository
- Last commit
Extended access
Why this level
- Scanner scripts and the hook run on the user machine.
- The GitHub repository check uses access to project settings.
Install
- Works in
Manual install
/plugin marketplace add netresearch/claude-code-marketplaceThen `/plugin install security-audit@netresearch-claude-code-marketplace`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Scanner scripts and the hook run on the user machine.
- The GitHub repository check uses access to project settings.
This is third-party code. Review the repository files before installing.
What it does
The `security-audit` skill teaches an agent to run a security review of code and GitHub projects. It builds on OWASP Top 10, CWE Top 25 for 2025, ASVS 4.0 and CVSS v3.1 and v4.0 scoring. The agent looks for XXE, SQL injection, XSS, CSRF, command injection, path traversal, insecure deserialization, SSRF, JWT flaws and session fixation, rates the severity of a finding and suggests a fix. PHP and TYPO3 get deeper scanning: `checkpoints.yaml` holds over 80 checkpoints, and 41 reference guides load on demand. A dispatcher script detects the project stack and runs matching scanners, and another script checks GitHub repository settings. A PreToolUse hook warns about risky shell commands, and the DevSecOps section covers CI pipelines, SAST, dependency scanning and the supply chain.
Who it is for. PHP and TYPO3 developers and security teams who need a repeatable code review and vulnerability scoring on one scale.
Good fit when
- Before a release the application code must go through the OWASP Top 10 list and produce a table of findings.
- A found vulnerability needs a CVSS v4.0 score and a priority.
- An XML parser accepts external entities and a secure replacement is needed.
- A GitHub repository should have its branch protection and dependency settings checked.
Not a fit when
- You need an active penetration test with exploitation: the skill reviews code and settings.
- The project stack differs while the deep checks target PHP and TYPO3.
- You need an opinion that replaces an auditor: agent scores need to be rechecked.
Example request
Review this PHP project for SQL injection and XSS and for each finding give the file, a CVSS v4.0 score and a fix.Limitations
General patterns fit any project, while the 80 checkpoints and scanner scripts target PHP and TYPO3. Installing through `npx skills` copies only `SKILL.md` files, so the hooks arrive with a marketplace or skills directory install. Scanners and scripts run on your machine, and the GitHub check uses access to the repository. The repository marks its texts as CC-BY-SA-4.0, so read the terms before reusing them in a product. Agent findings need manual verification and the CVSS score is indicative.
How to disable. Remove the `security-audit` plugin through `/plugin`. For a skills-directory install delete the `~/.claude/skills/security-audit` folder, and for an `npx skills` install remove the skill from the agent directory.
FAQ
How do I install the skill in Claude Code?
Run `/plugin marketplace add netresearch/claude-code-marketplace`, then `/plugin install security-audit@netresearch-claude-code-marketplace`. Without a marketplace: clone the repository into `~/.claude/skills/security-audit`.
Can I install the skill with npx?
Yes: `npx skills add https://github.com/netresearch/security-audit-skill --skill security-audit`. The command copies only `SKILL.md` and does not install hooks.
Which vulnerabilities does the skill cover?
XXE, SQL injection, XSS, CSRF, command injection, path traversal, file uploads, insecure deserialization, SSRF, type juggling, SSTI, JWT flaws, LDAP injection, email header injection and session fixation.
What does the PreToolUse hook do?
The `check_risky_command.py` script checks shell commands before they run and warns about risky ones. The hook ships with the plugin and does not work with an `npx skills` install.
Does the skill suit non-PHP projects?
Yes, the general OWASP, CWE and CVSS patterns and the GitHub project check apply to any stack. The 80 automated checkpoints target PHP and TYPO3.
Discussion
No questions or reviews yet.
Related
PluginsA skill for reviewing code for vulnerabilities against OWASP Top 10:2025, ASVS 5.0 and the 2026 lists for LLM and AI agent security
A code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
27 WordPress security skills: an agent checks nonces and capabilities, escapes output and reviews plugins with checklists.
Security checks for apps an agent wrote: rules for AGENTS.md, a live-site scanner and an audit across 17 vulnerability types
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
README in short
The skill is presented as a set of security audit patterns for any project with deep PHP and TYPO3 scanning. It lists install routes (marketplace, skills directory, npx, Composer and npm), example queries and the repository structure with scripts and references.