What exactly is included with the purchase of this security skill?

The skill includes a 20-point systematic audit engine, integration profiles for popular frameworks like Next.js and Supabase, and a remediation reporting template that provides actionable fixes for discovered vulnerabilities.

Which AI agents or platforms are compatible with this checklist?

This skill is designed to work with major LLM-based agents that have filesystem or repository access; it requires the ability to read your configuration files and API handlers to perform the audit.

How does this audit perform better than just asking a standard LLM to 'check my code for security'?

Unlike generic prompts, this skill uses a specialized framework-aware logic to distinguish between client-side and server-side vulnerabilities, specifically testing for nuanced risks like IDOR and AI-specific prompt injection that general models often miss.

Does this skill perform active penetration testing on my live website?

No, this is a static analysis and configuration audit tool; it identifies vulnerabilities within your codebase and architecture without performing active, potentially disruptive penetration tests on your live production server.

How much setup is required to start the security audit?

Simply provide the agent with access to your repository or specific configuration files and define your tech stack; the skill will then automatically map your application's architecture to begin the 20-point inspection.

Will I receive updates as new security threats or framework versions emerge?

Yes, the checklist is regularly updated to include new security patterns for emerging web trends, such as evolving best practices for AI rate limiting and new vulnerabilities found in modern meta-frameworks.

web app security checklist

Example session with this skill installed

I'm about to launch a Next.js app with Supabase and Stripe. Can you run a security check on my current repo to see if it's safe to ship?

Read your context and instructions
Compiled the web app security

I have completed the security audit for your Next.js, Supabase, and Stripe integration. I found one critical leak and two high-priority configuration issues.

Security Review: Project X Launch

Summary: The application has a critical secret leak in the frontend bundle and missing RLS policies on two Supabase tables. Payment logic is correctly verified via webhooks.

Critical

[1] Leaked Supabase Service Role Key | where: src/lib/supabase.ts | fix: Replace SERVICE_ROLE_KEY with NEXT_PUBLIC_SUPABASE_ANON_KEY for client-side use and move admin logic to a Server Action.

High / Medium / Low

[8] Missing RLS Policies | High | `public.user_profiles` and `public.orders` have RLS enabled but no policies, blocking all non-admin reads.

[11] No Login Rate Limiting | High | The `/api/auth` route lacks a rate limiter, leaving it open to brute-force attempts.

[18] Security Headers | Medium | Missing Content-Security-Policy and Strict-Transport-Security headers in next.config.js.

Results (Top 5)

#	Item	Status	Notes
1	Frontend Secrets	FAIL	Admin key exposed in browser bundle.
8	DB RLS	PARTIAL	Tables locked but no access policies defined.
17	Payment Verif	PASS	Stripe webhook signatures verified correctly.
2	.env in Git	PASS	`.env` correctly listed in `.gitignore`.
7	IDOR Checks	PASS	`owner_id` checks present in all Supabase queries.

Next steps

Rotate the Supabase Service Role Key immediately in the dashboard as it was exposed to the browser.
Apply RLS policies to allow users to read their own data using auth.uid().
Add upstash/ratelimit or similar middleware to your Next.js API routes.**

Connects securely to your tools. The creator never sees your data.

About this skill

Ship web applications with confidence by identifying vulnerabilities before they reach production. This skill provides a systematic 20-point security audit tailored for modern web stacks, including specific checks for AI-integrated features and payment flows. It moves beyond generic advice to provide actionable tests and minimal fixes for real-world codebases.

What it does

Secret Detection scans for leaked API keys in frontend bundles, environment files, and git history.
Access Control Audit verifies server-side permissions, IDOR vulnerabilities, and database row-level security.
Abuse Prevention checks rate limiting for auth endpoints and sets usage caps for AI API calls.
Input Validation identifies injection risks and cross-site scripting (XSS) in user-generated content.
Payment Verification audits webhook signatures and server-side fulfillment logic.

How it works

Application Mapping where you provide the tech stack, auth methods, and high-risk features like payments or AI.
Code Inspection where the agent analyzes your repo, configuration files, and API handlers.
Vulnerability Scoring which marks items as PASS, FAIL, or PARTIAL based on severity levels.
Remediation Reporting delivering a prioritized list of fixes and a formal security summary.

Frameworks & tools

Works with Next.js, React, Supabase, Firebase, Node.js, Django, and Laravel. Supports integration with scanners like gitleaks and trufflehog.

Why this beats prompting it yourself

Generic prompts often miss the nuances of client-side vs server-side execution in modern frameworks. This skill enforces a strict "least privilege" mindset and specific testing procedures, like cross-account IDOR checks, that generic LLMs typically overlook.

Use cases

Pre-launch Audit to catch leaked keys or missing rate limits before going live.
PR Security Review for checking new payment or file upload logic.
AI Cost Control to ensure user-facing LLM features are capped and protected from prompt injection.
Environment Hardening to verify production configs, CORS policies, and security headers.

Known limitations

Does not perform active penetration testing or dynamic scanning of live production environments. Requires manual permission for destructive actions like rewriting git history.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

6 installs

Downloaded by developers to date

Free forever

No account required to browse

web app security checklist