auditing-security-logging-completenesslisted

Audit whether an application actually records the security events an investigation would need, and whether the logs themselves leak or lie: a security decision (authentication, an authorization denial or sensitive grant, a credential or privilege change, access to sensitive data) that fires with no durable record, an audit entry missing the actor, target, or outcome, secrets or personal data flowing into a widely-readable log, and untrusted input written to a log without neutralizing line breaks so entries can be forged. Covers coverage gaps at the decision points, record sufficiency and tamper-resistance, log-as-disclosure, and log injection. Use when assessing whether the code emits the security signal downstream detection and forensics depend on. The security action or the secret is the source, the audit or log sink is the sink, and the missing or unsafe record is the finding.
UnboundCompute/security-agent-skills · ★ 4 · AI & Automation · score 80

Install: claude install-skill UnboundCompute/security-agent-skills

# Auditing security-logging completeness: whether the record exists when you need it Detection and forensics can only work with signals the application actually emits. A gate that denies access but writes nothing is invisible after the fact; a privilege change with no audit entry cannot be reconstructed; a log that quietly captures a token or an email address becomes a disclosure store; a log that accepts raw newlines can be forged to hide a trail. This audit is the mirror of the usual hunt: the source is a security-relevant action that must reach an audit sink, or a secret that must never reach a log sink, and the finding is a record that is missing, insufficient, leaking, or forgeable. You do it by enumerating the decisions that matter and following each to whether, and how, it is recorded. ## When to use - You are assessing whether an application produces the security events an investigation would need. - Authorization denials, authentication, privilege changes, or sensitive reads may go unrecorded. - Logs may capture secrets or personal data, or accept unneutralized untrusted input. ## Scope check Audit logging and log contents only in systems you own or are authorized to assess, and treat any secrets or personal data you find in logs as sensitive: report their presence, do not copy them out. If you can't name the authorization, stop. ## The loop 1. **Enumerate the security decisions that should be recorded.** Inventory where a security-relevant event happens: a