domains / families / security / security-audit

security-audit

combined

Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates to the Centinela (QA) agent. Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

When to use

• Before a release to verify security posture
• After significant code changes that touch authentication, authorization, or data handling
• Periodic security review of the codebase
• When adding new dependencies or external integrations
• Performing security audits on web applications
• Testing API security
• Conducting penetration tests
• Scanning for vulnerabilities

When not to use

• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Skill page

Conflict

The two copies describe different procedures. The davepoon copy is a single-agent audit that delegates to a Centinela QA agent, runs a SIGN IN checklist, checks OWASP A01-A10, scans for secrets and CVEs, optionally checks Solidity contracts, and writes a report to docs/reviews/security-audit-{date}.md. The sickn33 copy is a multi-phase workflow bundle that orchestrates many separate skills (scanning-tools, shodan-reconnaissance, vulnerability-scanner, sql-injection-testing, xss-html-injection, burp-suite-testing, api-fuzzing-bug-bounty, pentest-commands, metasploit-framework, etc.) across reconnaissance, scanning, web app testing, API testing, penetration testing, hardening, and reporting. Neither copy is a shortened or wrapped version of the other; each contains material steps and constraints the other lacks, so crowning one would hide a real alternative.