Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    Security Audit & Compliance Toolkit

    1

    A systematic security pass trained on OWASP Top 10, STRIDE threat modelling, CWE patterns, and compliance frameworks including SOC2, ISO 27001, GDPR and HIPAA.

    $12.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Security Audit & Compliance Toolkit

    Security Audit & Compliance Toolkit

    Example session with this skill installed

    Perform a security audit on my Node/Express API. I'm worried about OWASP vulnerabilities and hardcoded secrets in my git history. I also need to be GDPR compliant for EU users.

    • Read your context and instructions
    • Compiled the security audit

    Security Audit Results: Node/Express API

    Severity: Critical

    • Finding: Hardcoded AWS Access Key in config/db.js:14.
    • Finding: SQL Injection vulnerability in GET /users/:id via string concatenation.
    • GDPR Gap: Missing 'Right to Erasure' endpoint for PII deletion.

    Action: Rotate AWS keys immediately and use parameterized queries.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    A systematic security pass trained on OWASP Top 10, STRIDE threat modelling, CWE patterns, and compliance frameworks including SOC2, ISO 27001, GDPR and HIPAA. Point it at code, architecture diagrams, or infrastructure configs and it returns a ranked finding list with severity, exploitability, and a remediation playbook. Goes deeper than a linter: reasons about data flow, trust boundaries, and attacker motivations. Used for pre-launch audits, compliance gap assessments, and pre-pentest preparation. Specify your stack and compliance target — it returns a prioritised action list your engineering team can actually work from.

    • Cannot execute dynamic penetration tests or live exploits.
    • Static analysis may produce false positives.
    • Compliance reporting requires manual legal verification.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 4 months ago

    Permissions

    Terminal / Shell
    Read Files

    Reads your source code and runs the security scanners you already have installed (for example Semgrep, gitleaks, osv-scanner, npm audit or pip-audit).

    Listed4 months ago
    Updated12 days ago

    What's inside

    Frequently Asked Questions

    This toolkit performs a deep semantic analysis of codebases, architecture, and configs to identify vulnerabilities like OWASP Top 10 flaws, PII leaks, and compliance gaps across frameworks like SOC2 and GDPR.

    The toolkit is designed to be model-agnostic and works with any advanced LLM capable of processing large contexts, including GPT-4o, Claude 3.5 Sonnet, and specialized reasoning models.

    You receive the core logic for SAST reviews, specialized threat modeling templates for STRIDE/CWE, and automated remediation playbook generators for identified risks.

    Simply specify your technology stack and the compliance framework you are targeting; the skill will then guide you through the ingestion of your code or infrastructure configurations for analysis.

    Unlike generic tools, this skill factors in data flow and trust boundaries to rank findings by actual exploitability, ensuring your team focuses on critical risks rather than false positives.