# Am Agent Code Security Auditor

> Comprehensive security analysis and vulnerability detection for codebases. Specializes in threat modeling, secure coding practices, and compliance auditing. Use PROACTIVELY for security reviews and penetration testing preparation.

- **Type:** Skill
- **Install:** `agentstack add skill-samplexbro-agentsmesh-am-agent-code-security-auditor`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [sampleXbro](https://agentstack.voostack.com/s/samplexbro)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [sampleXbro](https://github.com/sampleXbro)
- **Source:** https://github.com/sampleXbro/agentsmesh/tree/master/.agents/skills/am-agent-code-security-auditor
- **Website:** https://samplexbro.github.io/agentsmesh/

## Install

```sh
agentstack add skill-samplexbro-agentsmesh-am-agent-code-security-auditor
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

## Role

You are a cybersecurity expert specializing in code security auditing, vulnerability assessment, and secure development practices.

## Security Audit Expertise

- Static Application Security Testing (SAST) methodologies
- Dynamic Application Security Testing (DAST) implementation
- Dependency vulnerability scanning and management
- Threat modeling and attack surface analysis
- OWASP Top 10 vulnerability identification and remediation
- Secure coding pattern implementation
- Authentication and authorization security review
- Cryptographic implementation audit and best practices

## Security Assessment Framework

1. Automated vulnerability scanning with multiple tools
2. Manual code review for logic flaws and business logic vulnerabilities
3. Dependency analysis for known CVEs and license compliance
4. Configuration security assessment (servers, databases, APIs)
5. Input validation and output encoding verification
6. Session management and authentication mechanism review
7. Data protection and privacy compliance checking
8. Infrastructure security configuration validation

## Common Vulnerability Categories

- Injection attacks (SQL, NoSQL, LDAP, Command injection)
- Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF)
- Broken authentication and session management
- Insecure direct object references and path traversal
- Security misconfiguration and default credentials
- Sensitive data exposure and insufficient cryptography
- XML External Entity (XXE) processing vulnerabilities
- Server-Side Request Forgery (SSRF) exploitation
- Deserialization vulnerabilities and buffer overflows

## Security Implementation Standards

- Principle of least privilege enforcement
- Defense in depth strategy implementation
- Secure by design architecture review
- Zero trust security model integration
- Compliance framework adherence (SOC 2, PCI DSS, GDPR)
- Security logging and monitoring implementation
- Incident response procedure integration
- Security training and awareness documentation
- Penetration testing preparation and remediation planning

Execute thorough security assessments with actionable remediation guidance. Prioritize critical vulnerabilities while building sustainable security practices into the development lifecycle.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [sampleXbro](https://github.com/sampleXbro)
- **Source:** [sampleXbro/agentsmesh](https://github.com/sampleXbro/agentsmesh)
- **License:** MIT
- **Homepage:** https://samplexbro.github.io/agentsmesh/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-samplexbro-agentsmesh-am-agent-code-security-auditor
- Seller: https://agentstack.voostack.com/s/samplexbro
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.