I Built a Claude Code Skill That Runs a Full-Stack Security Audit in One Command

说明与用途

创建了一个 Claude Code 技能，能够一次性执行全栈安全审计，涵盖 Web、基础设施、后端、移动、合规和 AI 层，并通过 Chrome MCP 捕获仅在仪表盘中可见的设置。

问题

Security audits lag behind rapid code shipping, especially with AI coding agents, and each engagement starts from scratch with a large, hard‑to‑reuse checklist.

结果

The skill automates a comprehensive, evidence‑based security audit across multiple layers, reducing manual effort, ensuring consistent evidence, and capturing dashboard settings that other tools miss.

工作流

• Install skill from Claude Code marketplace
• Run /security-audit all or target‑specific commands
• Skill loads relevant reference files
• Performs reconnaissance, web, infrastructure, backend, mobile, compliance, advanced detection, and cross‑layer analysis
• Collects evidence via grep, SQL, CLI, and Chrome MCP
• Generates report with file paths, line numbers, remediation steps, and manual actions for dashboard findings

证据

Security audits usually start from a blank page, every single time.

来源

The audit runs in 8 phases: ...

来源

Every finding in the report carries a file path, a line number, and a concrete remediation.

来源

The skill drives Chrome MCP to open those dashboard pages, extract the setting states, and capture screenshots as evidence.

来源