Security Audit Skill

Reusable workflow extracted from luca-security-expert expertise.

Conduct comprehensive security assessments to identify vulnerabilities, assess risks, provide remediation aligned with OWASP, zero-trust, and compliance.

When to Use

Pre-release validation | Post-incident review | Compliance prep (SOC2, ISO27001, GDPR) | Vendor assessment | Pentest planning | Architecture review | Incident response | Posture assessment

Workflow

Step	Actions
1. Scope	Identify assets (apps, infra, data), boundaries, authorization, compliance (GDPR, HIPAA, PCI-DSS), timeline
2. Info Gathering	Map attack surface, inventory assets/tech, review architecture/data flows, existing docs, critical functions
3. Threat Model	Apply STRIDE (Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation), actors, attack vectors, prioritize
4. Vulnerability Assessment	OWASP Top 10, auth/authz, injection, session mgmt, crypto, API security, infrastructure, dependencies
5. Risk Analysis	Calculate risk (Likelihood × Impact), classify severity, business impact, compensating controls, prioritize
6. Pentest	Manual testing, automated scanning (Burp, ZAP), exploitation (controlled), privilege escalation, lateral movement
7. Remediation	Prioritized roadmap, fix recommendations, compensating controls, effort/timeline, validation criteria
8. Report & Validate	Document findings + evidence, executive summary, technical details, re-test after fixes, update baseline

Inputs

• Scope (systems, apps, infrastructure)
• Authorization (written permission)
• Access (test credentials, environment)
• Documentation (architecture, stack, security docs)
• Compliance (GDPR, HIPAA, PCI-DSS, etc.)
• Constraints (testing windows, off-limits)

Outputs

• Security Assessment Report (findings + evidence)
• Risk Register (vulnerabilities by severity/impact)
• Remediation Roadmap (prioritized fixes + timeline)
• Executive Summary (high-level risk overview)
• Technical Details (exploitation + fix guidance)
• Compliance Gap Analysis

OWASP Top 10

See owasp-checklist.md for complete A01-A10 verification items.

Risk Rating

Severity	Likelihood × Impact	Action	Timeline
Critical	High + High	Data breach, system compromise	24 hours
High	High + Med or Med + High	Significant security risk	7 days
Medium	Med + Med or Low + High	Moderate security concern	30 days
Low	Low + Low or Low + Med	Minor security issue	Next release

Risk Calculation: Likelihood (Low/Med/High) × Impact (Low/Med/High/Critical) = Priority

Example

Input: Pre-release audit for financial app

Steps:
1. Scope: Web + API + DB, PCI-DSS required
2. Info: React, Node.js, PostgreSQL, AWS
3. Threat Model: STRIDE → data exposure, injection risks
4. Vulnerabilities:
   🔴 CRITICAL: SQL injection in payment endpoint
   🔴 CRITICAL: JWT tokens never expire
   🟠 HIGH: Weak password (6 chars, no complexity)
   🟡 MEDIUM: Missing rate limiting
   🟢 LOW: Security headers not optimized
5. Risk: SQL injection = HIGH × CRITICAL = P0
6. Remediation:
   P0: Parameterized queries, token expiration (24h)
   P1: Password policy, rate limiting (7d)
   P2: Security headers (next sprint)
7. Report: Executive + technical + roadmap
8. Validate: Re-test after fixes

Output: BLOCKED - 2 critical fixes required first

Security Tools

Category	Tools
Vulnerability Scanning	OWASP ZAP, Burp Suite, Nmap, Nikto
Code Analysis	SonarQube, Snyk, Semgrep, GitHub CodeQL
Infrastructure	Trivy, Checkov, AWS Security Hub, Prowler
Auth Testing	Hydra, John the Ripper, Hashcat

Zero-Trust Principles

1. Verify Explicitly: Always authenticate/authorize
2. Least Privilege: Minimal permissions
3. Assume Breach: Design for compromise, limit blast radius
4. Microsegmentation: Isolate workloads/networks
5. Continuous Monitoring: Real-time threat detection

Compliance Frameworks

Framework	Focus	Key Requirements
GDPR	Data Privacy	Protection by design/default, Right to erasure, 72h breach notification, Privacy impact assessments
SOC2	Security Controls	Security, availability, processing integrity, confidentiality, privacy, Annual audits
ISO27001	Info Security	114 controls across 14 domains, Risk management, Continuous improvement
PCI-DSS	Payment Card	Secure network, Protect cardholder data, Vulnerability mgmt, Monitoring/testing

Related Agents

• luca-security-expert - Full reasoning and threat analysis
• rex-code-reviewer - Code-level security review
• baccio-tech-architect - Security architecture validation
• marco-devops-engineer - Infrastructure security
• elena-legal-compliance-expert - Regulatory compliance

Engineering Fundamentals

• Threat modeling (STRIDE/DREAD) for all features
• Static/dynamic security testing in CI/CD
• Shift-left security: early pipeline checks
• Dependency scanning automated
• Container security: image scanning, runtime protection
• Secret management: vault-based, no secrets in code
• Security code review checklist for every PR