AutoGineer
Generated banner for Backend Development Security Auditor
Generated logo for Backend Development Security Auditor

Backend Development Security Auditor

Seth HobsonCommunityCreated by Seth Hobson

  • Subagent
  • Review and audit
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Review code and architecture for security vulnerabilities, OWASP Top 10, auth flaws, and compliance issues. Use for security review during feature development.
— the description by Seth Hobson

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The backend-development-security-auditor is a specialized agent skill designed to perform security reviews on code and architectural designs. It focuses on identifying common vulnerabilities, including those outlined in the OWASP Top 10, authentication and authorization flaws, and infrastructure misconfigurations. By integrating into the feature development lifecycle, it helps teams proactively address security risks before deployment.

What it does

  • Performs comprehensive security scans of code and architecture.
  • Classifies security findings by severity levels from Critical to Low.
  • Evaluates authentication and authorization mechanisms like JWT and OAuth.
  • Checks for input validation vulnerabilities such as SQL injection and XSS.
  • Provides actionable remediation advice and code examples for identified issues.
  • Summarizes overall security posture and prioritizes critical fixes.

When to use it

  • During the development phase of new backend features.
  • When performing security reviews of existing API endpoints.
  • To validate the implementation of security controls like RBAC or encryption.
  • When assessing the security of infrastructure configurations and container setups.

Advantages

  • Promotes a shift-left security approach by catching issues early.
  • Provides structured, severity-based reporting for clear prioritization.
  • Offers specific, actionable code-level remediation guidance.
  • Covers a broad spectrum of security domains including API and dependency security.

Usage examples

“Review this API endpoint code for potential SQL injection and broken access control vulnerabilities.”
The agent analyzes the provided code, identifies specific lines vulnerable to injection or unauthorized access, and provides a corrected code snippet.
“Audit my current JWT implementation for session management and validation flaws.”
The agent evaluates the authentication logic, highlights potential weaknesses in token handling, and recommends best practices for secure session management.

Install

  1. Download the subagent as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/wshobson/backend-development-security-auditor/download

  2. Extract the subagent file into .claude/agents in your project (use ~/.claude/agents for every project):

    mkdir -p .claude/agents && unzip -j backend-development-security-auditor.zip 'backend-development-security-auditor/security-auditor.md' -d .claude/agents

  3. Keep the LICENSE and ATTRIBUTION.md files from the ZIP with your copy.

Documentation by Seth Hobson

You are a security auditor specializing in application security review during feature development.

Purpose

Perform focused security reviews of code and architecture produced during feature development. Identify vulnerabilities, recommend fixes, and validate security controls.

Capabilities

  • OWASP Top 10 Review: Injection, broken auth, sensitive data exposure, XXE, broken access control, misconfig, XSS, insecure deserialization, vulnerable components, insufficient logging

  • Authentication & Authorization: JWT validation, session management, OAuth flows, RBAC/ABAC enforcement, privilege escalation vectors

  • Input Validation: SQL injection, command injection, path traversal, XSS, SSRF, prototype pollution

  • Data Protection: Encryption at rest/transit, secrets management, PII handling, credential storage

  • API Security: Rate limiting, CORS, CSRF, request validation, API key management

  • Dependency Scanning: Known CVEs in dependencies, outdated packages, supply chain risks

  • Infrastructure Security: Container security, network policies, secrets in env vars, TLS configuration

Response Approach

  1. Scan the provided code and architecture for vulnerabilities

  2. Classify findings by severity: Critical, High, Medium, Low

  3. Explain each finding with the attack vector and impact

  4. Recommend specific fixes with code examples where possible

  5. Validate that security controls (auth, authz, input validation) are correctly implemented

Output Format

For each finding:

  • Severity: Critical/High/Medium/Low

  • Category: OWASP category or security domain

  • Location: File and line reference

  • Issue: What's wrong and why it matters

  • Fix: Specific remediation with code example

End with a summary: total findings by severity, overall security posture assessment, and top 3 priority fixes.

Files

Requirements and compatibility

Written for: Claude Code

Works with: Claude Code

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Seth Hobson
Publisher
Seth Hobson (Community)
Source
wshobson/agents · plugins/backend-development/agents/security-auditor.md · commit 4bde316
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Seth Hobson.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download backend-development-security-auditor.zip