This Claude Code Security Skill Found 21 Real Bugs

0:00It's almost the end of October, but it's actually being called Black October because there's over 27 major security instance that happened in the last 40 hours from major products like PHP, no.js, Java, GitLabs, or even things like Signal, WordPress, and so much more products that are being used by millions of people. And now these products are being hacked by AI simply because we have so many open way models or open- source models that are getting really, really smart that can actually be used to hacking other people's system. And that's why in this video, I'm going to share with you this number one skill called security audit skill that

0:33actually helped me to discover so many vulnerabilities that I didn't even realize for my entire application that I've been building for over 6 months where there's actually real users on this application. So that's why in this video I'm going to share with you exactly how I was able to using the skill to do a full audit for my applications as well as how I was able to fix them and also verify that the things are actually fixed. Now, like I said, if your application here, there's a huge vulnerabilities. Make sure that you rotate your keys, focus on security first before you're actually going to building any other features. So, with

1:01that being said, if you're interested for this video, let's get into it. All right. So, to get started right here, you can see I navigated to security audit skill from Cloudflare. And if you want to install this, simply scroll down. You can see it tells you exactly how can we install this. So, if you want to install this globally, you can simply just run this command. If you want to install this per project, you can just copy that command right here. Now, right here, I'm just going to navigate to my terminal for my projects, and I'm going to run this command right here, and it's going to install this onto my current

1:29project. Now, currently, you can see it's asking for which AI agent here should we use. Uh, I'm just going to go down and using claw code and just click on enter. And here, we're just going to install for project base using sim link and yes to proceed. And here you can see it's asking for install skill. We can also say yes to that. And now, you can see we have this fully installed. So next thing we're going to do here is once we have that installed uh we can be able to simply just use our claw code and just give it a prompt like security audit for this codebase and then it's

2:00going to go ahead and try to do that. So in this case I'm going to copy the first prompt and I'm going to start my current claw code session and here I'm just going to paste that prompt do a security review for this codebase and if you want to trigger the skill specifically you can also do slash and it's called the security audit. You can see that we have our security audit skill right here. All

2:18right, so just a couple updates here. You can see we have multiple different AI agent here running. So currently we're doing the audit job. So in this case, let's wait for a bit until it fully completes. All right, so after some time here, you can see it came back with a full reports of where are all the

2:32vulnerabilities are in the top three. You can see here is the security keys, the free credits and team data here. Sub here you can see we have some vulnerability in our applications. And I also ask another sub agent here to verify this entire report by spinning up, you know, multiple different sub agent here to verify to see if it's true using a temporary database. And out of those 26 problems, we have 21 of them are real, three of them not, and two of them are not checked yet. So total we have 18 tickets in the ready column here. And pretty much we are ranking those tickets by the severity. You can

3:04see that for new user cannot be able to read the master data key, which is not good. Anyone can be able to read the change for the free credit list, right? So you can see these are something that we want to fix in our application, right? Most developers they're only focusing on building things. So you know security is a big thing. So that's why having this skill here is going to help us to catch those vulnerability early before we actually going to have our application here to be right. So this is a big deal and essentially what I did here is I basically have it to creating

3:31a bunch of tickets right inside of our you know chem board and you can see we have 18 tickets and essentially what I did here is basically using the skill called wayfinder from Matt PCO skill here to taking this entire report and breaking that into different tickets that we have. So then what I did here is basically trigger my subboard which is my software factory and take a look at the entire project coming board using codeex here because I'm currently pretty low on the clock usage. So I do have these tickets here are currently fed out and basically having different AI agent here to work on them right we have our

4:03builder QA and reviewer here and basically it's going to process each and every single tickets using the codec suites so in this case I'm going to have AI agent here to work on those tickets and we'll come back once all the tickets are complete all right so after we have processed all the tickets here you can see that we have merged all the tickets into the productions and all the 16 tickets are closed as well as some additional tickets that we have mentioned so total roughly around 18 tickets. And here you can see if I were to take a look at our keman board, we have zero tickets in the ready column

4:31and zero in the builder or QA or reviewer, all of them are merged to done. And after I merge them to done, I also run the entire security audit again. And you can see as a result, we pretty much have only like two small bugs that it has found, but nothing as big as what we see earlier, right? So pretty much we have verify the entire security audits after the changes are merged into the production and then trigger the skill again to making sure that the actual security vulnerability here are no more. Right? So that's exactly how you can be able to uh do a audit and be able to do the fix right be

5:06using either wayfinder or whatever spec driven development skills you could think of and then be able to using multiple different sub agent here to process all those tickets in parallel and be able to get them merged in and be able to patch this vulnerabilities. Okay, after that you will just do a audit again and see if there's any more uh things that you want to fix. Okay, so pretty much that's exactly how you can using the security audit skill here from Cloudflare to basically spot for any

5:30vulnerabilities in your entire codebase. Now you might be wondering, okay, there's also a skill called the clock security review. Now I also did a check for this. So claw code security review versus the cloud player security audits. There are two different skills. One is searching for the entire vulnerabilities in the entire codebase. And the other one here is looking for specifically on the recent changes, right? So reason the changes and look at the nearby code. And this is going to be really useful especially if you want to let's say creating multiple pull requests and you want to run the skill after the pull request is run, right? So it's only

6:02checking for the changes that it has made on that pull request. Whereas the Cloudflare skill here is probably going to be due like maybe like once a month or maybe like once a sprint, right? Like a two week sprint. and you want to make sure that your codebase here doesn't have any secure vulnerabilities that

6:17maybe AI agent have overlooked, right? So if you never run any security vulnerabilities, you can check using the skill first. And if you want to run this like every single time on every pull request, then you can using the security review skill from the enthropic. So pretty much that's the entire video here. If you do find this video, please make sure to like this video. And of course, if you're curious about how I was able to using my entire software factories to shipping products and features autonomously, then you can check out this video right here. So, pretty much that's it. I'll see you in

6:43the next video.