Security Auditing Workflow Bundle

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate

Before each active security action, state the exact target URL, IP, account, or resource, the written-authorization confirmation, permitted scope, exact command, expected effect and limits. Without confirmation, remain read-only and provide defensive guidance only. Wait for explicit confirmation in the current conversation before executing it. Existing scope does not authorize expanding targets or techniques.

Overview

Comprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation.

When to Use This Workflow

Use this workflow when:

• Performing security audits on web applications
• Testing API security
• Conducting penetration tests
• Scanning for vulnerabilities
• Hardening application security
• Compliance security assessments

Before active testing, obtain written authorization naming exact targets, accounts, techniques, time window, request/concurrency/byte limits, prohibited actions and stop conditions. Select approved phases rather than launching every referenced skill. Use owned test fixtures for injections, exploitation and account actions; never extract real customer data or persist access to prove impact. Static source/dependency review may proceed within authorized read scope. Separate suspected scanner signals from reproduced findings, preserve redacted evidence and record untested scope.

Workflow Phases

Phase 1: Reconnaissance

Skills to Invoke

• scanning-tools - Security scanning
• shodan-reconnaissance - Shodan searches
• top-web-vulnerabilities - OWASP Top 10

Actions

1. Identify target scope
2. Gather intelligence
3. Map attack surface
4. Identify technologies
5. Document findings

Copy-Paste Prompts

Use @scanning-tools to perform initial reconnaissance

Use @shodan-reconnaissance to find exposed services

Phase 2: Vulnerability Scanning

Skills to Invoke

• vulnerability-scanner - Vulnerability analysis
• security-scanning-security-sast - Static analysis
• security-scanning-security-dependencies - Dependency scanning

Actions

1. Run automated scanners
2. Perform static analysis
3. Scan dependencies
4. Identify misconfigurations
5. Document vulnerabilities

Copy-Paste Prompts

Use @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities

Use @security-scanning-security-dependencies to audit dependencies

Phase 3: Web Application Testing

Skills to Invoke

• top-web-vulnerabilities - OWASP vulnerabilities
• sql-injection-testing - SQL injection
• xss-html-injection - XSS testing
• broken-authentication - Authentication testing
• idor-testing - IDOR testing
• file-path-traversal - Path traversal
• burp-suite-testing - Burp Suite testing

Actions

1. Test for injection flaws
2. Test authentication mechanisms
3. Test session management
4. Test access controls
5. Test input validation
6. Test security headers

Copy-Paste Prompts

Use @sql-injection-testing to test for SQL injection vulnerabilities

Use @xss-html-injection to test for cross-site scripting

Use @broken-authentication to test authentication security

Phase 4: API Security Testing

Skills to Invoke

• api-fuzzing-bug-bounty - API fuzzing
• api-security-best-practices - API security

Actions

1. Enumerate API endpoints
2. Test authentication/authorization
3. Test rate limiting
4. Test input validation
5. Test error handling
6. Document API vulnerabilities

Use @api-fuzzing-bug-bounty to fuzz API endpoints

Use @pentest-checklist to plan penetration test

Use @pentest-commands to execute penetration testing

Use @security-scanning-security-hardening to harden application security