A software audit skill for solo builders

An agent skill that helps AI coding assistants find common security and privacy issues before they ship, including exposed secrets, broken access control, insecure data handling, and risky dependencies.

Built by Luigi Morel, software engineer and independent consultant at Krafted.

This standalone skill audits web and mobile applications for security and privacy issues: exposed secrets, broken access control, JWT/session flaws, dependency CVEs, unsafe database policies, sensitive logging, injection, missing rate limits, business-logic abuse, payment weaknesses, and insecure mobile storage.

Designed for solo developers and small teams. Findings are prioritized by real-world impact, supported by file/line evidence, explained in plain language, and paired with practical fixes.

The default workflow is read-only. It does not run exploits, brute-force authentication, or touch production systems. It does not change files unless explicitly asked. It never reproduces full secrets.

Install the skill in your project's .agents/software-audit-skill/ directory. Keep SKILL.md and the references/ directory together so the skill can load its guides.

From your project root, clone this repository into the skill directory:

git clone https://github.com/luigimorel/software-audit-skill.git .agents/software-audit-skill

The installed layout should look like this:

.agents/ └── software-audit-skill/ ├── SKILL.md └── references/

Restart or refresh your coding agent if it does not detect the skill immediately.

software-audit-skill/ ├── SKILL.md ├── README.md ├── CONTRIBUTING.md ├── LICENSE └── references/ ├── access-and-auth.md ├── baas-rules.md ├── data-exposure-and-logging.md ├── injection-and-abuse.md ├── integrations.md ├── money-and-pricing.md ├── mobile.md ├── rate-limiting.md ├── rule-register.md └── secrets-and-config.md

Security references

OWASP Top 10

OWASP API Security Top 10

OWASP MASVS

GitHub Security Advisories

OSV vulnerability database

NIST National Vulnerability Database

npm audit documentation

Composer audit documentation

Next.js security advisories

Node.js jsonwebtoken advisories

express-rate-limit advisories

Use current advisories during each audit; this list is a starting point, not an exhaustive or permanently current CVE catalogue.