Run comprehensive security audit
Runs comprehensive security audit detecting vulnerabilities by project type and generating detailed reports with fixes.
/plugin marketplace add teliha/dev-workflows/plugin install dev-workflows@dev-workflowsRun a comprehensive security audit of your codebase.
This command automatically detects your project type and applies appropriate security checks:
audit skill for deep analysisSolidity:
Next.js:
Simply run:
/audit
The audit will:
The audit generates a report: audits/[ProjectName]_audit_[DATE].md
Report includes:
// CRITICAL: Reentrancy vulnerability
function withdraw() external {
msg.sender.call{value: balance[msg.sender]}(""); // ❌ External call first
balance[msg.sender] = 0; // ❌ State change after
}
// FIX:
function withdraw() external {
uint256 amount = balance[msg.sender];
balance[msg.sender] = 0; // ✅ State change first
msg.sender.call{value: amount}(""); // ✅ External call after
}
// HIGH: No authentication check
export async function GET(req: Request) {
const users = await db.users.findMany(); // ❌ No auth
return Response.json(users);
}
// FIX:
export async function GET(req: Request) {
const session = await auth(req); // ✅ Check auth
if (!session) return Response.json({ error: 'Unauthorized' }, { status: 401 });
const users = await db.users.findMany();
return Response.json(users);
}
// MEDIUM: XSS vulnerability
<div dangerouslySetInnerHTML={{ __html: userInput }} /> // ❌ Unescaped user input
// FIX:
import DOMPurify from 'isomorphic-dompurify';
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} /> // ✅ Sanitized
The audit can be run automatically in GitHub Actions:
name: Security Audit
on:
schedule:
- cron: "0 3 * * 1" # Weekly
workflow_dispatch:
jobs:
audit:
uses: teliha/dev-workflows/.github/workflows/security-audit.yml@main
secrets:
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
For best results, create a CLAUDE.md in your repository root:
## Project Overview
[Brief description of your project]
## Security Considerations
- [List security-critical features]
- [Known security patterns used]
- [External integrations]
## Architecture
- [Key components]
- [Trust boundaries]
- [External dependencies]
This helps the audit understand your specific context and patterns.