Security Audit Skill

Core Principle

Never trust anything from outside your control. Every external input is a potential attack vector.

Phase 1: Threat Surface Mapping

Before auditing, identify what you're protecting and where attacks can come from.

Questions to Answer

1. What sensitive data does this app handle? (PII, payments, auth tokens, health data)
2. What are all the entry points? (APIs, forms, file uploads, webhooks, URL params)
3. What external services does it connect to? (databases, third-party APIs, cloud services)
4. Who are the user types and what should each access?
5. What's the deployment environment? (cloud provider, containers, serverless)