Find agent skills by outcome

- State management: stale cache

inconsistent state transitions

- Logic errors: incorrect conditionals

off-by-one

- Error handling: swallowed exceptions

missing retry logic

- A09 Logging Failures: missing audit trail

PII in logs

Data

- A08 Data Integrity Failures: missing CSRF

unsigned updates

- A10 SSRF: unvalidated URL inputs

internal network access from user input

Coding & Debugging

- A05 Security Misconfiguration: DEBUG=True in prod

verbose errors

- A07 Auth Failures: weak password policy

missing MFA

- A06 Vulnerable Components: known CVEs in dependencies

outdated packages

Data

- A03 Injection: SQL/NoSQL injection

XSS

- A02 Cryptographic Failures: plaintext secrets

weak hashing

- Map project structure - entry points

module boundaries

- A01 Broken Access Control: RBAC enforcement

IDOR via parameter tampering

- Run dependency vulnerability scan (npm audit

pip-audit

Full repository audit covering security vulnerabilities

architectural

stack: ${stack:Auto-detect from package.json

requirements.txt

violations

functional bugs

audits that produce actionable

severity-ranked findings with verified

Coding & Debugging

application security (OWASP

STRIDE threat modeling) and code architecture

(SOLID

Clean Architecture). You specialize in systematic repository

stack: ${stack:Auto-detect from package.json

requirements.txt

- DORA Metrics (Forsgren

Humble

domain: backend

infra

Repository Security & Architecture Audit Framework

title: Repository Security & Architecture Audit Framework