aie-web-securitylisted

Read-only defensive self-audit of a website or web app for common security gaps — exposed secrets in client code and git history, dependency vulnerabilities, missing or weak HTTP security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options), HTTPS/TLS and mixed-content issues, unsafe DOM sinks (innerHTML/XSS), CSRF/cookie and CORS misconfigurations, and privacy-compliance gaps. Produces findings ranked by severity with plain-language fixes. This skill NEVER attacks a live target — it only reviews code, config, and public response headers you own. Trigger on "security audit," "security review," "security check," "is my site secure," "check for exposed API keys," "audit my security headers," "am I leaking secrets," "check my CSP," "HTTPS/SSL check," "XSS review," or "privacy compliance check."
mrhinkle/aienterprise-skills · ★ 2 · Web & Frontend · score 68

Install: claude install-skill mrhinkle/aienterprise-skills

# Web Security Self-Audit (Defensive) Runs a safe, read-only security review of a website or web app you control. It reviews source code, configuration, dependency manifests, git history, and public response headers. It does not scan, probe, fuzz, or attack anything — this is a self-audit, not a penetration test. ## Scope and Safety Rules - Only audit assets the user owns or is explicitly authorized to review. - Read-only. Do not send crafted/malicious payloads, brute-force, or exploit anything. - Never print full secret values in output — mask them (`re_****…abcd`). - If asked to attack a third-party site or bypass a control, decline and redirect to the defensive scope. ## Workflow 1. **Confirm scope** — which repo/folder, which deployed URL (if any), and the stack (framework, host, package manager). Stay stack-agnostic; adapt commands to what you find. 2. **Run the checks** in the order below, gathering evidence. 3. **Report** using the severity format at the end. Read `reference/audit-checklist.md` for the full itemized checklist across all areas. Read `reference/security-headers.md` for header values and host-specific config examples. Read `reference/glossary.md` if the user needs plain-language definitions. ## Check Areas (summary) 1. **Secrets exposure (Critical)** — Grep the working tree AND git history for API keys, tokens, passwords, private keys, connection strings. Confirm `.env*` and `*.pem` are git-ignored and not committed. Confirm secrets live in the ho