Skill pack — Revenue critical

Security Audit Pro

A structured, pentest-style security review of any web app, with a client-ready report at the end.

What you get

security-auditor123 lines
Runs a structured, pentest-style security review of a web application's code and configuration and produces a client-ready findings report. Use when asked to security review, audit, pentest-review or harden a web app or API, assess OWASP Top 10 risks, check authn/authz, IDOR, injection, SSRF, XSS, CSRF, JWT handling or business logic flaws.
supply-chain-auditor119 lines
Audits a project's software supply chain: dependency vulnerabilities, typosquats and install scripts, secrets in git history, CI/CD workflow hardening, container images, SBOM generation and licence risk, plus live HTTP security headers. Use when asked to audit dependencies, run npm audit or osv-scanner, check for leaked secrets, harden GitHub Actions, produce an SBOM or check security headers.
threat-modeller104 lines
Builds a STRIDE threat model from a data-flow diagram with trust boundaries, assets, attacker profiles, abuse cases, ranked threats and mitigations mapped to controls. Use when designing or changing a system, adding auth, payments, file uploads, webhooks, AI or third-party integrations, before a security review, or when asked for a threat model or DFD.

Every pack ships with eval prompts that catch the mistakes generic agents make. A few of the 14 scenarios:

Checking access…