Security Auditor (Security)

Download SKILL.mdGet Murage How skills work

Open source. macOS, Windows and Linux.

At a glance

What it is

Security vulnerability assessment expertise covering OWASP Top 10 deep dive, code review for security, dependency vulnerability scanning, SAST/DAST tools, security headers audit, authentication and authorization audit, and security assessment report writing for identifying and documenting application security weaknesses.

A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.

File: SKILL.md
Length: 508 lines2,148 words, about 10 min read
Category: Securityapplication security
Level: Intermediate
License

More security skills.

The full skill.

The whole file, exactly as it downloads. Read it before you rely on it.

SKILL.md

508 lines · 2,148 words

Download

Security Auditor

Overview

Security auditing is the systematic evaluation of an application's security posture. This skill covers the methodologies, tools, and techniques for identifying vulnerabilities in code, configuration, dependencies, and architecture. The goal is to find weaknesses before attackers do, and to provide clear, actionable remediation guidance.

OWASP Top 10 Deep Dive (2021)

A01: Broken Access Control

The most critical web application vulnerability. Access control enforces that users cannot act outside their intended permissions.

Put this skill to work.

Questions.

What is the Security Auditor (Security) skill?

How much does it cost?

Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.

Can I change it?

Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.

Give your first job to Murage.

Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.

Download Murage

No account needed · Runs on the AI plan you already pay for

Category	Key Check	Common Fix
A06: Vulnerable Components	Run `npm audit`, `pip-audit`, `trivy`	Update dependencies, use lockfiles
A07: Auth Failures	Test brute force, session fixation, credential stuffing	Rate limiting, MFA, secure session management
A08: Software/Data Integrity	Verify CI/CD pipeline integrity, check for deserialization	Signed artifacts, SRI, safe deserialization
A09: Logging Failures	Check if security events are logged, log injection	Structured logging, SIEM integration
A10: SSRF	Test URL parameters for internal network access	Allowlist URLs, block private IPs, use network segmentation

Check	What to Test	Expected Behavior
Password policy	Minimum length, complexity	>= 12 chars, no common passwords
Brute force protection	100+ rapid login attempts	Account lockout or rate limiting after 5-10 attempts
Session management	Session token entropy	>= 128 bits of randomness
Session fixation	Set session before auth, check after	New session ID issued after login
Logout	Click logout, reuse session token	Session invalidated server-side
Remember me	Inspect persistent cookie	Separate, rotatable token, not session ID
Password reset	Request reset, inspect token	Time-limited (1h), single-use, random
MFA bypass	Skip MFA step, direct API call	MFA enforced at API level, not just UI

Security Auditor (Security)

More security skills.

The full skill.

Security Auditor

Overview

OWASP Top 10 Deep Dive (2021)

A01: Broken Access Control

Put this skill to work.

Questions.

Give your first job to Murage.

Search murage.ai

Security Auditor (Security)

More security skills.

The full skill.

Security Auditor

Overview

OWASP Top 10 Deep Dive (2021)

A01: Broken Access Control

Put this skill to work.

Questions.

Give your first job to Murage.

Create a bot and use this skill.

Ask Ember to create the bot

Open the bot’s skills

Find Security Auditor (Security) and switch it on

Ask the bot for the job

About this skill.

A02: Cryptographic Failures

A03: Injection

A04: Insecure Design

A05: Security Misconfiguration

A06-A10 Summary

Code Review for Security

Secure Code Review Checklist

Dangerous Function Patterns to Search For

Dependency Vulnerability Scanning

Dependency Policy

SAST/DAST Tools

Static Application Security Testing (SAST)

Dynamic Application Security Testing (DAST)

Security Headers Audit

Authentication Audit

Security Assessment Report Template

CI/CD Security Integration

When to Use

Output Format

Example

Edge Cases