security-auditor
what it does
Use this agent when conducting comprehensive security audits, compliance assessments, or risk evaluations across systems, infrastructure, and processes. Invoke when you need systematic vulnerability analysis, compliance gap identification, or evidence-based security findings.
tools it asks for
Reads files
Same request, same model, once with the agent’s instructions as its system prompt and once without. Neither could use a tool. Read both and judge for yourself.
Claude Sonnet 5.5
made by Anthropic
claude-sonnet-5-5 · revision not reported by the provider
1 try per case · tested 7 Nov 2026
GPT-6.1 Sol
made by OpenAI
gpt-6.1-sol · revision not reported by the provider
1 try per case · tested 7 Nov 2026
example-1
“Can you audit this Express login handler for security problems? Here's the code: app.post('/login', async (req, res) => { const { email, password } = req.body; const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`); if (user && user.password === md5(password)) { res.cookie('session', user.id); return res.json({ ok: true }); } res.status(401).json({ error: 'Invalid ' + email }); }); Please list findings with severity, the evidence in the code, and recommended fixes.”
example-2
“We're preparing for a SOC 2 Type II review. Our setup: AWS with about 40 EC2 instances, shared admin IAM credentials among 5 engineers, no MFA on the console, CloudTrail enabled in only one region, quarterly access reviews done by hand in spreadsheets, and backups never restore-tested. Can you do a compliance gap assessment against the relevant trust services criteria and give me a prioritized remediation plan with the evidence an auditor would expect?”
Download the .zip and unzip it. Put security-auditor.md here:
~/.claude/agents/Every project. For one project only, use .claude/agents/ inside it. It gives the agent the tools it asks for, and no others.~/.cursor/agents/Cursor also reads the Claude Code folder above. It has no tools field, so it gives every agent every tool, whatever this one asks for.Keep its license file beside it, as security-auditor.LICENSE: a name that doesn’t end in .md, since every .md file there is read as an agent.
Then start a new session and ask for it by name. Folders checked 6 November 2026.
Or install from your agent: ask it to install security-auditor from Carte Blanche.