Security audit for your web app before launch
Get a written security audit of your web app before launch or after a big feature. Covers the API, sign-in and OAuth, MCP connectors or CLIs, and file uploads, and writes a threat model plus numbered findings with severity, fix, and how each fix was verified. Reads the code and runs signed-out checks only; never changes your code.
SkillSecurityVersion: A saved state of a kit. When the author changes it, they share a new version with a higher number, and the old one stays exactly as it was. 0.1.2 (latest)
- Activity
- New: be the first to try it
Will this work for me?
- Effort
- Works out of the boxOur guess from what the kit says it needs.
- Works in
- Claude Code, claude.ai and the desktop app
- You need
- Nothing else. Add it to Claude and ask.
Safety label
- Who made it
- SlashClone house account
- What it touches
- Reads ** and writes to docs/security-review/**
- Scan
How this works
- It is a skill: written instructions Claude reads when your request matches what the skill is for. You do not call it by name; just ask for the task.
- While it works, it reads and changes files in the places it lists, nowhere else.
- Nothing runs until you choose to use it, and you can remove it any time.
What it can access
What this kit says it will touch, the same list you see before you add it. These are its Permissions: What a kit is allowed to touch on your computer or accounts, such as reading a folder or using the internet. You see them before you add it.. In Claude Code they become rules, so Claude stops anything not on the list.
Reads
Reads files in ./**
Writes
Writes files in ./docs/security-review/**
- Works with
- Claude Code
- License
- MIT