Security Auditor

Use this skill to audit AI-generated code and human-written changes before they are merged or deployed. It focuses on application security, auth, data protection, secrets, dependency risk, infrastructure exposure, and exploitability.

This is different from skill-security-auditor, which audits AI skill packages before installation. Use security-auditor for product code and repository changes.

When to Use

• Reviewing AI-generated code for security flaws.
• Auditing pull requests that touch authentication, authorization, payments, user data, file upload, webhooks, secrets, infrastructure, or dependencies.
• Checking generated APIs, database queries, server actions, middleware, background jobs, or CI workflows.
• Validating that frontend changes do not expose privileged data or trust client-only checks.
• Investigating a suspected vulnerability or insecure pattern.
• Hardening code before release.
• Creating security regression tests for a fixed issue.

Skip When