security-auditorUse when reviewing code for security vulnerabilities, implementing authentication flows, auditing OWASP Top 10, configuring CORS/CSP headers, handling secrets, input validation, SQL injection prevention, XSS protection, or any security-related code review.
Install via ClawdBot CLI:
clawdbot install jgarrison929/security-auditorGrade Excellent — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
process.env.API_KEYPotentially destructive shell commands in tool definitions
eval(Calls external URL not in known-safe list
https://api.example.comAI Analysis
The skill definition contains no actual code execution, credential harvesting, or data exfiltration logic; it is a static prompt template for a security review assistant. The flagged signals appear to be examples within the instructional code snippets (e.g., `process.env.API_KEY`, `https://api.example.com`) used to illustrate secure coding practices, not operational commands.
Generated Mar 1, 2026
Audit an online store's checkout and payment processing code to prevent SQL injection, XSS, and broken access control vulnerabilities, ensuring secure handling of customer data and transactions. Focus on OWASP Top 10 compliance, especially around authentication flows and input validation for user inputs.
Design and review secure authentication and authorization systems, including JWT token validation and OAuth integration, to protect sensitive financial data and prevent unauthorized access. Ensure encryption of secrets and adherence to least privilege principles in user roles.
Conduct a security review of APIs handling patient health records, checking for vulnerabilities like injection attacks, misconfigured CORS/CSP headers, and data leakage. Implement input validation and secure data transmission to comply with regulations like HIPAA.
Perform penetration testing on user-generated content features to identify and mitigate XSS and CSRF vulnerabilities, ensuring proper sanitization and security headers. Audit code for secure handling of secrets and prevention of information leakage.
Offer on-demand security audits and code reviews to businesses, charging per project or hourly rates for vulnerability assessments and secure coding guidance. Revenue is generated through client contracts and retainer agreements for ongoing support.
Integrate the skill into a SaaS platform that provides automated security scanning and reporting, with subscription tiers for different levels of audit depth and compliance checks. Revenue comes from monthly or annual subscriptions from developers and enterprises.
Develop and sell training courses or certification programs on secure coding practices, leveraging the skill's expertise in OWASP Top 10 and vulnerability prevention. Revenue is generated through course fees, workshops, and certification renewals.
💬 Integration Tip
Integrate this skill into CI/CD pipelines for automated security checks during code commits, and use it in code review tools to provide real-time vulnerability feedback to developers.
Scored Apr 16, 2026
Audited Apr 16, 2026 · audit v1.0
gws CLI: Shared patterns for authentication, global flags, and output formatting.
Set up Gmail API access via gog CLI with manual OAuth flow. Use when setting up Gmail integration, renewing expired OAuth tokens, or troubleshooting Gmail authentication on headless servers.
Automate OAuth login flows with user confirmation via Telegram. Supports 7 providers: Google, Apple, Microsoft, GitHub, Discord, WeChat, QQ. Features: - Auto-detect available OAuth options on login pages - Ask user to choose via Telegram when multiple options exist - Confirm before authorizing - Handle account selection and consent pages automatically
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Zoho People API integration with managed OAuth. Manage employees, departments, designations, attendance, and leave. Use this skill when users want to read, create, update, or query HR data like employees, departments, designations, and forms in Zoho People. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Requires network access and valid Maton API key.
Build secure authentication with sessions, JWT, OAuth, passwordless, MFA, and SSO for web and mobile apps.