A Claude Skill (SKILL.md) for auditing the security of web applications — with a 50-point checklist tailored for modern full-stack projects.
ใช้ตรวจความปลอดภัยเว็บแบบเป็นระบบ อ้างอิง OWASP Top 10 และ tailor เฉพาะ stack จริง
Drop this skill into your Claude environment (or use it as a manual checklist) to run a structured security review covering 10 categories / 50 checks:
| # | Category | Checks |
|---|---|---|
| A | Authentication & Session | 1–7 |
| B | Authorization / Access Control | 8–12 |
| C | Injection & Input Validation | 13–20 |
| D | Security Headers & Config | 21–26 |
| E | Data Protection & Crypto | 27–31 |
| F | API Security | 32–36 |
| G | Payment Security (Omise/PromptPay) |
37–42 |
| H | File Upload & Handling | 43–45 |
| I | Dependency & Supply Chain | 46–48 |
| J | Error Handling & Business Logic | 49–50 |
Examples and checks are written for real code patterns in:
Next.js 14 · Laravel · MongoDB · Drizzle/PostgreSQL · NextAuth.js · Socket.IO · Omise/PromptPay · ESP32/MQTT
As a Claude Skill: place SKILL.md in your skills directory. It triggers on requests like "ตรวจความปลอดภัยเว็บ", "audit my code", "หาช่องโหว่", "is this secure?".
As a manual checklist: open SKILL.md and walk through the 50 items while reviewing your code. Each item includes a vulnerable ❌ vs safe ✅ example and a fix.
For defensive use on systems you own or are authorized to test only. Not for attacking third-party systems or generating exploits.
MIT — see LICENSE.
Made by @devpanitan · Freelance Full-Stack Developer