# Security Auditor Saas

> >

- **Type:** Skill
- **Install:** `agentstack add skill-batterfried-philosophy172-agent-startup-skills-security-auditor-saas`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [batterfried-philosophy172](https://agentstack.voostack.com/s/batterfried-philosophy172)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [batterfried-philosophy172](https://github.com/batterfried-philosophy172)
- **Source:** https://github.com/batterfried-philosophy172/Agent-Startup-Skills/tree/main/skills/security-auditor-saas

## Install

```sh
agentstack add skill-batterfried-philosophy172-agent-startup-skills-security-auditor-saas
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Auditor — Hardening Agent

## Purpose

Identify and remediate security vulnerabilities before the product is deployed.
Prevent data breaches, unauthorized access, and common attack vectors.

## When to Use

- After code and tests are complete
- Before deployment planning
- When the user asks "is this code secure?"

## Audit Checklist (OWASP Top 10 Aligned)

### 1. Injection (SQL, NoSQL, Command)
- [ ] All database queries use parameterized statements or ORM
- [ ] No string concatenation in queries
- [ ] User input is never passed directly to system commands

### 2. Broken Authentication
- [ ] Passwords are hashed with bcrypt/argon2 (never plain text, never MD5/SHA)
- [ ] Sessions expire after a reasonable timeout
- [ ] Login has rate limiting or brute-force protection
- [ ] Password reset tokens are single-use and time-limited

### 3. Sensitive Data Exposure
- [ ] No secrets in source code (API keys, passwords, tokens)
- [ ] `.env` files are in `.gitignore`
- [ ] HTTPS is enforced in production
- [ ] Sensitive data is not logged

### 4. Broken Access Control
- [ ] Users cannot access other users' data by changing IDs in URLs
- [ ] Admin routes are protected with role checks
- [ ] API endpoints verify the requesting user's permissions

### 5. Security Misconfiguration
- [ ] CORS is configured to allow only known origins
- [ ] Debug mode is disabled in production config
- [ ] Default credentials are changed
- [ ] Error messages do not expose stack traces to users

### 6. Cross-Site Scripting (XSS)
- [ ] All user-generated content is escaped/sanitized before rendering
- [ ] Content-Security-Policy headers are set
- [ ] React/Vue/Angular auto-escaping is not bypassed (no dangerouslySetInnerHTML)

### 7. Cross-Site Request Forgery (CSRF)
- [ ] CSRF tokens are used on state-changing forms
- [ ] SameSite cookie attribute is set

### 8. Insecure Dependencies
- [ ] No known vulnerable dependencies (check npm audit / pip audit)
- [ ] Dependencies are pinned to specific versions

### 9. Insufficient Logging
- [ ] Failed login attempts are logged
- [ ] Access to sensitive data is logged
- [ ] Logs do not contain passwords or tokens

### 10. Input Validation
- [ ] All inputs have type, length, and format validation
- [ ] File uploads are restricted by type and size
- [ ] Email addresses are validated

## Output

Produce a `security_audit.md` with:

| # | Finding | Severity | Location | Remediation |
|---|---|---|---|---|
| 1 | Hardcoded API key | CRITICAL | src/lib/api.js:14 | Move to .env |

## Rules
- **Critical/High findings MUST be fixed before deployment.**
- Present fixes to the CEO for approval.
- Re-audit after fixes are applied.

## Exit Criteria
- All 10 OWASP categories are checked
- All Critical/High findings are remediated
- Audit report is complete with pass/fail for each category

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [batterfried-philosophy172](https://github.com/batterfried-philosophy172)
- **Source:** [batterfried-philosophy172/Agent-Startup-Skills](https://github.com/batterfried-philosophy172/Agent-Startup-Skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-batterfried-philosophy172-agent-startup-skills-security-auditor-saas
- Seller: https://agentstack.voostack.com/s/batterfried-philosophy172
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.