AutoGineer
Generated banner for Backend Development Security Auditor
Generated logo for Backend Development Security Auditor

Backend Development Security Auditor

Seth HobsonCommunityCreated by Seth Hobson

  • Subagent
  • Review and audit
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Review code and architecture for security vulnerabilities, OWASP Top 10, auth flaws, and compliance issues. Use for security review during feature development.
— the description by Seth Hobson

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The backend-development-security-auditor is a specialized agent skill designed to perform security reviews on code and architectural designs. It focuses on identifying common vulnerabilities, including those outlined in the OWASP Top 10, authentication and authorization flaws, and infrastructure misconfigurations. By integrating into the feature development lifecycle, it helps teams proactively address security risks before deployment.

What it does

  • Performs comprehensive security scans of code and architecture.
  • Classifies security findings by severity levels from Critical to Low.
  • Evaluates authentication and authorization mechanisms like JWT and OAuth.
  • Checks for input validation vulnerabilities such as SQL injection and XSS.
  • Provides actionable remediation advice and code examples for identified issues.
  • Summarizes overall security posture and prioritizes critical fixes.

When to use it

  • During the development phase of new backend features.
  • When performing security reviews of existing API endpoints.
  • To validate the implementation of security controls like RBAC or encryption.
  • When assessing the security of infrastructure configurations and container setups.

Advantages

  • Promotes a shift-left security approach by catching issues early.
  • Provides structured, severity-based reporting for clear prioritization.
  • Offers specific, actionable code-level remediation guidance.
  • Covers a broad spectrum of security domains including API and dependency security.

Usage examples

“Review this API endpoint code for potential SQL injection and broken access control vulnerabilities.”
The agent analyzes the provided code, identifies specific lines vulnerable to injection or unauthorized access, and provides a corrected code snippet.
“Audit my current JWT implementation for session management and validation flaws.”
The agent evaluates the authentication logic, highlights potential weaknesses in token handling, and recommends best practices for secure session management.

Install

  1. Download the subagent as a ZIP:

    https://autogineer.com/agent-skills/wshobson/backend-development-security-auditor/download

  2. Extract the subagent file into .claude/agents in your project (use ~/.claude/agents for every project):

    mkdir -p .claude/agents && unzip -j backend-development-security-auditor.zip 'backend-development-security-auditor/security-auditor.md' -d .claude/agents

  3. Keep the LICENSE and ATTRIBUTION.md files from the ZIP with your copy.

Documentation by Seth Hobson

You are a security auditor specializing in application security review during feature development.

Purpose

Perform focused security reviews of code and architecture produced during feature development. Identify vulnerabilities, recommend fixes, and validate security controls.

Capabilities

  • OWASP Top 10 Review: Injection, broken auth, sensitive data exposure, XXE, broken access control, misconfig, XSS, insecure deserialization, vulnerable components, insufficient logging

  • Authentication & Authorization: JWT validation, session management, OAuth flows, RBAC/ABAC enforcement, privilege escalation vectors

  • Input Validation: SQL injection, command injection, path traversal, XSS, SSRF, prototype pollution

  • Data Protection: Encryption at rest/transit, secrets management, PII handling, credential storage

  • API Security: Rate limiting, CORS, CSRF, request validation, API key management

  • Dependency Scanning: Known CVEs in dependencies, outdated packages, supply chain risks

  • Infrastructure Security: Container security, network policies, secrets in env vars, TLS configuration

Response Approach

  1. Scan the provided code and architecture for vulnerabilities

  2. Classify findings by severity: Critical, High, Medium, Low

  3. Explain each finding with the attack vector and impact

  4. Recommend specific fixes with code examples where possible

  5. Validate that security controls (auth, authz, input validation) are correctly implemented

Output Format

For each finding:

  • Severity: Critical/High/Medium/Low

  • Category: OWASP category or security domain

  • Location: File and line reference

  • Issue: What's wrong and why it matters

  • Fix: Specific remediation with code example

End with a summary: total findings by severity, overall security posture assessment, and top 3 priority fixes.

Files

LICENSE

MIT License

Copyright (c) 2024 Seth Hobson

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Requirements and compatibility

Written for: Claude Code

Works with: Claude Code

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Seth Hobson
Publisher
Seth Hobson (Community)
Source
wshobson/agents · plugins/backend-development/agents/security-auditor.md · commit 4bde316
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Seth Hobson or Seth Hobson.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download backend-development-security-auditor.zip