domains / families / security / security-auditor

security-auditor

combined

Use when reviewing code for security vulnerabilities, implementing authentication flows, auditing OWASP Top 10, configuring CORS/CSP headers, handling secrets, input validation, SQL injection prevention, XSS protection, or any security-related code review. Expert security auditor specializing in DevSecOps, comprehensive

When to use

• Running security audits or risk assessments
• Reviewing SDLC security controls, CI/CD, or compliance readiness
• Investigating vulnerabilities or designing mitigation plans
• Validating authentication, authorization, and data protection controls
• Expert security auditor with comprehensive knowledge of modern cybersecurity practices, DevSecOps methodologies, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure coding practices, and security automation…

When not to use

• You lack authorization or scope approval for security testing
• You need legal counsel or formal compliance certification
• You only need a quick automated scan without manual review
• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Skill page

Conflict

The first two copies (rmyndharis and sickn33) are nearly identical, with sickn33 adding specific adversarial steps (Data Flow Tracing, IDOR checks) and middleware validation. The third copy (LeoYeAI) is a distinct, code-centric skill focused on OWASP Top 10 implementation with specific TypeScript/React examples and a different audit process. Because the first two represent a high-level DevSecOps/compliance approach while the third represents a low-level code review approach, and the first two have diverged to include specific manual verification steps not in the original, they should be combined to capture both the high-level process and the specific code-level checks.