Security Audit Pack for Claude Code

Five skills that make Claude Code audit your own code like a careful security engineer. It finds exploitable vulnerabilities, leaked secrets and risky dependencies, proves each finding before reporting it, and hands you the fix.

$4.99one-time, VAT included where it applies Buy now for $4.99 Or get all 7 kits for $9.99

Instant download: a zip with 5 skills, a setup guide and an example THREATS.md. The $9.99 bundle gets you all 7 kits (35 skills). Free updates. 14-day refund, no questions asked.

What's inside

Skill	What it does
`audit-code`	Reviews a repo or PR for injection, broken access control, SSRF, path traversal, XSS, unsafe deserialization and crypto misuse. Every finding comes with its file and line, a concrete attack path, a severity and a fix, and is verified before it's reported. Optional `--fix` applies the fixes with a regression test for each.
`scan-secrets`	Finds keys and credentials in your working tree and git history, separates real ones from test values and placeholders, and gives a step-by-step rotation and cleanup plan. Never prints full secret values.
`audit-dependencies`	Runs npm audit, pip-audit, cargo audit, govulncheck, bundler-audit and others, checks whether the vulnerable code is actually reachable from your app, and proposes the smallest safe upgrades.
`threat-model`	Reads your code and writes a short STRIDE-style `THREATS.md`: assets, entry points, trust boundaries and the top risks with mitigations, which `audit-code` then checks first.
`harden-config`	Checks security headers, CSP, CORS, cookies, TLS, Dockerfiles, CI permissions, cloud IAM and env handling, and proposes small diffs with a note on what each could break.

What an audit looks like

Example output from audit-code on a small invoicing API:

2 findings (1 Critical, 1 High) in invoice access and the logo fetcher.

### 1. [Critical] Any user can read any invoice (IDOR)
src/routes/invoices.ts:27
GET /invoices/:id loads the invoice by id without checking it belongs
to the caller's organization.
Attack: sign up as a new customer, request /invoices/1..N, receive other
customers' invoices.
Fix: Invoice.findOne({ id, orgId: req.user.orgId }), return 404 when null.
Confirmed (integration test with two users: second user got 200).

### 2. [High] Logo URL fetch allows SSRF
src/routes/logo.ts:12
The server fetches any user-supplied URL, including http://169.254.169.254/.
Fix: allow https only and block private and link-local addresses after DNS
resolution, or accept uploads instead of URLs.

Checked and fine: login (bcrypt, rate limited), Stripe webhook (signature verified).

Requirements

Claude Code, with any plan or API key that runs it.
Any language or framework. The skills read your repo to learn how it's built.
Optional: gitleaks or trufflehog, your ecosystem's audit tool (pip-audit, cargo audit, govulncheck, bundler-audit) and the GitHub CLI (gh). Each skill tells you what's missing and how to install it.

The skills help you review your own code faster and more thoroughly. They don't replace a professional security audit or penetration test.

Install in two minutes

unzip security-audit-pack-1.0.0.zip
mkdir -p ~/.claude/skills
cp -R security-audit-pack/skills/* ~/.claude/skills/

Then say "threat model this app" or "audit this repo for vulnerabilities" in any repo.

License

Use and modify the skills in your own projects and inside your company, including in private repos. You can't resell or redistribute them. Full terms.