/security-audit
Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and exploitability risks
$ npx -y skills add josstei/maestro-orchestrate --skill security-audit --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/security-audit
Context preview
The summary Claude sees to decide when to auto-load this skill.
Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and exploitability risks
SKILL.md
security-audit.SKILL.mdname: security-audit description: Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and exploitability risks
Maestro Security Audit
Call `get_skill_content` with resources: ["architecture"].
Protocol
Before delegating, call `get_skill_content` with resources: ["delegation"] and follow the returned methodology.
Workflow
1. Define the audit scope from the user request and relevant code paths 2. Trace trust boundaries, auth flows, secret handling, and data exposure paths 3. Review for exploitable flaws, unsafe defaults, OWASP Top 10 vulnerabilities, and high-risk dependencies 4. Classify findings by severity (CVSS-aligned) with file references and exploitability assessment 5. Provide remediation guidance with the highest-risk issues first
Constraints
- Prefer actionable findings over generic security advice
- Present findings before proposing remediation
- State clearly when the review is limited by unavailable runtime context
- Do not modify code without explicit user approval
Maestro is a multi-agent development orchestration platform with 39 specialists, an Express path for simple work, a 4-phase standard workflow for medium and complex work, persistent session state, and standalone
Repo: josstei/maestro-orchestrate
Other skills on maestro-orchestrate.
- /a11y-audit
Run a Maestro-style accessibility audit for WCAG compliance, ARIA usage, keyboard navigation, and screen reader compatibility
Open skill - /archive
Archive the active Maestro session while preserving the shared state layout
Open skill - /code-review
Standalone code review methodology for structured, severity-classified code assessment
Open skill - /compliance-check
Run a Maestro-style regulatory compliance review for GDPR/CCPA, cookie consent, data handling, and licensing
Open skill - /debug-workflow
Run the Maestro debugging workflow for investigation-heavy tasks
Open skill - /delegation
Agent delegation best practices for constructing effective subagent prompts with proper scoping
Open skill