Contact
Security Guardrail

Security Audit

Security audit patterns for PHP applications following OWASP guidelines. Covers XXE, SQL injection, XSS, CSRF detection, CVSS v3.1 scoring, and secure coding practices. By Netresearch.

Latest release v2.11.11

Install

Choose a supported route below. Package contents, agent registration and runtime dependencies can differ between installers.

  1. Claude Code via this marketplace 
    /plugin install security-audit@netresearch-claude-code-marketplace

    First add the marketplace once in Claude Code: /plugin marketplace add netresearch/claude-code-marketplace. Then install the selected plugin. For setup and installation scopes, see Claude Code plugin setup A plugin can include several skills and additional components.

  2. npx interactive skill selection 
    npx skills add https://github.com/netresearch/security-audit-skill

    Requires Node.js 22.20+. Run from the target project, then choose the source skills and agents in the installer. Uses the skills CLI from skills.sh Installs skill instructions. Extra plugin hooks, commands and external runtime tools are not installed by this route.

  3. composer require PHP project, as a package 
    composer require netresearch/security-audit-skill

    Allow the Composer skill installer to activate and approve skill registration when prompted. Requires netresearch/composer-agent-skill-plugin Discovers trusted skill packages and registers their instructions in AGENTS.md. Runtime tools may need separate setup.

  4. composer skills:add PHP project, direct source 
    composer skills:add netresearch/security-audit-skill

    Install and activate netresearch/composer-agent-skill-plugin first; approve the selected source's skill registration. Provided by netresearch/composer-agent-skill-plugin Pins source repositories without a Packagist package and records them in composer.skills.lock. Runtime dependencies remain separate.

What you can do with it

  • Vulnerability Assessment: XXE injection, SQL injection, XSS, CSRF, command injection, path traversal, file upload vulnerabilities, insecure deserialization, SSRF, type juggling, SSTI, JWT flaws, LDAP injection, email header injection, session fixation
  • Risk Scoring: CVSS v3.1 and v4.0 scoring methodology, risk matrix assessment, impact and likelihood analysis, prioritization frameworks
  • Secure Coding: Input validation, output encoding, cryptographic best practices (sodium), session management, authentication patterns, security headers
  • Standards Compliance: OWASP Top 10, CWE Top 25 (2025), OWASP ASVS v4.0, Proactive Controls — applicable to any project
  • PHP/TYPO3 Deep Scanning: 80+ automated checkpoints, PHP 8.x security features, framework patterns (TYPO3, Symfony, Laravel)
  • DevSecOps: CI/CD security pipeline, SAST, dependency scanning, supply chain security, SLSA

What you get back

  • Security findings with risk assessment and remediation recommendations for the reviewed code and configured checks.

What it expects in your project

Check the source README for current examples, requirements and limitations. Open full README

Tags

  • security
  • quality-security