测试与安全

auditing-security

Name: auditing-security
Author: spencerpauly

spencerpauly/aw…r-skills

Perform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns.

安装命令

$ npx skills add https://github.com/spencerpauly/awesome-cursor-skills --skill auditing-security

SKILL.md

Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

Scan for hardcoded secrets — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like:
- password=, secret=, token=, api_key=
- Base64-encoded credentials
- AWS keys (AKIA...), Stripe keys (sk_live_...), GitHub tokens (ghp_...)
- Files: .env committed to git, config.json with credentials
Check authentication & authorization
- Verify all API routes check authentication before processing.
- Ensure role-based access control is enforced server-side, not just in the UI.
- Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).
- Verify session tokens are HTTP-only, secure, and have reasonable expiry.