Full-stack vulnerability assessment skill covering Application, Infrastructure, Backend, Mobile, Compliance, and Advanced Detection. Combines codebase static analysis, CLI/SQL configuration checks, and Chrome MCP dashboard inspection to audit all layers end-to-end.

When NOT to Use This Skill

Runtime testing: This skill performs static analysis only. Use DAST tools (ZAP, Burp Suite) for runtime testing.
Penetration testing execution: This skill identifies vulnerabilities but does not exploit them.
Compliance certification: Findings inform compliance but do not constitute a formal audit.
Non-security code review: Use code-reviewer agent for general code quality.

Rationalizations to Reject

When evaluating findings, reject these false-positive rationalizations:

"It's behind authentication" — Authenticated users can still be attackers
"We'll fix it later" — Security debt compounds; Critical/High must be fixed now
"It's only in dev/staging" — Credentials and patterns often leak to production

When NOT to Use This Skill

Runtime testing: This skill performs static analysis only. Use DAST tools (ZAP, Burp Suite) for runtime testing.
Penetration testing execution: This skill identifies vulnerabilities but does not exploit them.
Compliance certification: Findings inform compliance but do not constitute a formal audit.
Non-security code review: Use code-reviewer agent for general code quality.

Rationalizations to Reject

When evaluating findings, reject these false-positive rationalizations:

"It's behind authentication" — Authenticated users can still be attackers
"We'll fix it later" — Security debt compounds; Critical/High must be fixed now
"It's only in dev/staging" — Credentials and patterns often leak to production

Priority	Check	Method
Critical	Server Actions auth/authz/validation	Grep
Critical	Next.js version CVE assessment	Bash
Critical	`NEXT_PUBLIC_` secret exposure	Grep
High	Middleware bypass resistance	Grep
High	Image optimization SSRF (remotePatterns)	Grep
High	CSP and security headers	Grep
Medium	Server/Client Component data leakage	Grep

Priority	Check	Method
Critical	Environment variable secret exposure	CLI
High	Deployment Protection settings	Chrome MCP
High	Git Fork Protection	Chrome MCP
Medium	Firewall / WAF rules	Chrome MCP

Priority	Check	Method
Critical	SQL Injection (raw queries, ORM misuse)	Grep
Critical	Command Injection detection	Grep
Critical	Insecure deserialization detection	Grep
High	Django DEBUG/SECRET_KEY/ALLOWED_HOSTS	Grep
High	SSTI (template injection)	Grep
Medium	CSRF configuration	Grep

Priority	Check	Method
Critical	Keychain access attributes	Grep
Critical	ATS config and Certificate Pinning	Grep + Bash
Critical	Biometric authentication	Grep
High	NSUserDefaults sensitive data	Grep
High	WebView security	Grep

Priority	Check	Method
Critical	SharedPreferences sensitive data	Grep
Critical	Network Security Config	Grep
Critical	Exported components	Grep
High	WebView JavaScript enabled	Grep
High	Root/emulator detection	Grep

Priority	Check	Method
Critical	RLS enabled on all public tables	SQL
Critical	service_role key client exposure	Grep
Critical	Overly permissive RLS policies	SQL
High	SECURITY DEFINER functions	SQL
High	Auth settings (MFA, email confirm)	Chrome MCP

Priority	Check	Method
Critical	PAN/credit card data in code	Grep
Critical	PHI field exposure	Grep
High	Encryption at rest/in transit	Grep
High	Audit logging implementation	Grep
Medium	Access control / RBAC	Grep

Priority	Check	Method
Critical	PII field identification	Grep
Critical	Consent management	Grep
High	Data retention policies	Grep
High	Right to erasure implementation	Grep
Medium	Data classification	Grep

Priority	Check	Method
Critical	Hardcoded secrets in code/history	Grep + Bash
Critical	Prompt injection vulnerabilities	Grep
Critical	Container running as root	Grep
High	GitHub Actions unpinned actions	Grep
High	Dependency confusion risk	Grep + Bash
High	Kubernetes RBAC misconfig	Grep
Medium	SBOM generation	Bash

Tool	Purpose
Grep/Glob	Static pattern detection in code
Bash	CLI commands (npm audit, pip-audit, cargo-audit, etc.)
Bash (SQL)	Direct Supabase DB queries (RLS status, etc.)
Bash (Cloud CLI)	AWS CLI, gcloud, az commands for infrastructure audit
Chrome MCP	Vercel/Supabase dashboard settings inspection
security-reviewer agent	OWASP Top 10 code review
security role	Threat modeling, CVE correlation
WebSearch	Latest CVE/advisory lookup

Security Audit

When NOT to Use This Skill

Rationalizations to Reject

Security Audit

When NOT to Use This Skill

Rationalizations to Reject

Design Principles

Prerequisites

Chrome MCP Dashboard Inspection

Execution Model

Stage 1: Static Analysis (Parallelizable via Subagents)

Stage 2: Dashboard Inspection (Main Context Only)

Execution Rules

Report Generation

Chrome MCP Dashboard Findings

Target Selection

Phase 1: Reconnaissance

Phase 2: Web Application Audit

Next.js — See references/nextjs-security.md

General Web — See references/web-testing.md

Phase 3: Infrastructure Audit

Vercel — See references/vercel-security.md

Supabase — See references/supabase-security.md

Terraform — See references/terraform-security.md

AWS — See references/aws-security.md

GCP — See references/gcp-security.md

Azure — See references/azure-security.md

Phase 4: Backend Audit

Python (Django/FastAPI/Flask) — See references/python-security.md

Go — See references/go-security.md

Ruby on Rails — See references/rails-security.md

Rust — See references/rust-security.md

Phase 5: Mobile Audit

iOS — See references/ios-testing.md

Android — See references/android-security.md

Flutter — See references/flutter-security.md

React Native — See references/react-native-security.md

Phase 6: Compliance Audit

Financial (PCI-DSS/HIPAA/SOX) — See references/compliance-financial.md

Privacy (GDPR/CCPA/SOC2/ISO27001) — See references/compliance-privacy.md

Phase 7: Advanced Detection

Supply Chain — See references/supply-chain-security.md

Container and Kubernetes — See references/container-security.md

CI/CD Pipeline — See references/cicd-security.md

Secret Scanning — See references/secret-scanning.md

LLM/AI Security — See references/llm-security.md

Phase 8: Cross-Layer Analysis

Report Format

Tools and Agents

1password

Springboot Security

Security Review

Laravel Security

Security Review

Django Security

Next.js — See `references/nextjs-security.md`

General Web — See `references/web-testing.md`

Vercel — See `references/vercel-security.md`

Supabase — See `references/supabase-security.md`

Terraform — See `references/terraform-security.md`

AWS — See `references/aws-security.md`

GCP — See `references/gcp-security.md`

Azure — See `references/azure-security.md`

Python (Django/FastAPI/Flask) — See `references/python-security.md`

Go — See `references/go-security.md`

Ruby on Rails — See `references/rails-security.md`

Rust — See `references/rust-security.md`

iOS — See `references/ios-testing.md`

Android — See `references/android-security.md`

Flutter — See `references/flutter-security.md`

React Native — See `references/react-native-security.md`

Financial (PCI-DSS/HIPAA/SOX) — See `references/compliance-financial.md`

Privacy (GDPR/CCPA/SOC2/ISO27001) — See `references/compliance-privacy.md`

Supply Chain — See `references/supply-chain-security.md`

Container and Kubernetes — See `references/container-security.md`

CI/CD Pipeline — See `references/cicd-security.md`

Secret Scanning — See `references/secret-scanning.md`

LLM/AI Security — See `references/llm-security.md`