Security Audit Skill

Perform comprehensive security audits on codebases to identify vulnerabilities before they reach production.

When to Use This Skill

• User mentions "security", "audit", "vulnerability", "CVE"
• Before deployment commands
• During PR reviews
• User asks about dependencies
• Periodic security checks

Audit Checklist

1. Secrets Exposure

Check for hardcoded secrets:

bash
# Search for common secret patterns
grep -rn "API_KEY\|SECRET\|TOKEN\|PASSWORD" --include="*.{js,ts,py,go,rb,java}" .
grep -rn "sk-\|pk_\|api_\|secret_" --include="*.{js,ts,py,go,rb,java}" .

Verify .gitignore:

bash
# Ensure sensitive files are ignored
cat .gitignore | grep -E "\.env|secret|credential|\.pem|\.key"

Check git history for leaked secrets:

bash
# Search recent commits (requires git-secrets or truffleHog)
git log -p --all -S "API_KEY" --since="30 days ago"

✅ Pass criteria:

• No hardcoded API keys, tokens, or passwords
• .env files in .gitignore
• No secrets in git history

2. Dependency Vulnerabilities

Node.js:

bash
npm audit
# or
yarn audit
# or  
pnpm audit

Python:

bash
pip-audit
# or
safety check

Go:

bash
govulncheck ./...

Rust:

bash
cargo audit

✅ Pass criteria:

• No critical vulnerabilities
• No high vulnerabilities > 30 days old
• Dependencies updated within last 90 days

3. Input Validation

Check for:

• User inputs sanitized before use
• SQL queries use parameterized statements
• File paths validated and sandboxed
• HTML content escaped before rendering
• Command injection prevention

Common vulnerable patterns:

javascript
// BAD: SQL injection
db.query(`SELECT * FROM users WHERE id = ${userId}`)

// GOOD: Parameterized query
db.query('SELECT * FROM users WHERE id = ?', [userId])

python
# BAD: Command injection
os.system(f"convert {user_file}")

# GOOD: Use subprocess with list
subprocess.run(["convert", user_file], check=True)

4. Authentication & Authorization

Check for:

• Passwords hashed with bcrypt/argon2 (not MD5/SHA1)
• Session tokens are cryptographically random
• Sessions expire appropriately
• CSRF protection on state-changing endpoints
• Rate limiting on auth endpoints
• Account lockout after failed attempts

Look for:

javascript
// BAD: Weak hashing
crypto.createHash('md5').update(password)

// GOOD: Bcrypt
bcrypt.hash(password, 12)

5. HTTPS & Transport Security

Check for:

• HTTPS enforced (HSTS header)
• Secure cookie flags (Secure, HttpOnly, SameSite)
• No mixed content warnings
• TLS 1.2+ required

6. Error Handling

Check for:

• Stack traces not exposed in production
• Generic error messages for users
• Detailed errors only in logs
• Sensitive data not in error messages

javascript
// BAD: Exposes internals
res.status(500).send({ error: err.stack })

// GOOD: Generic message
res.status(500).send({ error: 'An unexpected error occurred' })

7. File Upload Security

If file uploads exist:

• Validate file type server-side (not just extension)
• Limit file size
• Scan for malware
• Store outside webroot
• Rename uploaded files

8. API Security

• Authentication required on all sensitive endpoints
• Authorization checks per resource
• Rate limiting implemented
• CORS configured restrictively
• API versioning in place

Severity Levels

| Level | Description | Action Required | |-------|-------------|-----------------| | 🔴 Critical | Actively exploitable | Block deployment | | 🟠 High | Exploitable with effort | Fix within 7 days | | 🟡 Medium | Requires conditions | Fix within 30 days | | 🟢 Low | Minimal impact | Fix when convenient |

Output Format

markdown
## Security Audit Results

**Project:** [name]
**Date:** [date]
**Auditor:** Claude (automated)

### Summary

| Severity | Count |
|----------|-------|
| 🔴 Critical | 0 |
| 🟠 High | 1 |
| 🟡 Medium | 2 |
| 🟢 Low | 3 |

### Findings

#### 1. [🟠 High] Hardcoded API Key

**Location:** `src/config.js:15`
**Description:** API key for payment provider is hardcoded
**Risk:** If source code is leaked, attackers gain API access
**Recommendation:** Move to environment variable

• const STRIPE_KEY = 'sk_live_abc123...'

+ const STRIPE_KEY = process.env.STRIPE_SECRET_KEY

#### 2. [🟡 Medium] Missing Rate Limiting

**Location:** `src/routes/auth.js`
**Description:** Login endpoint has no rate limiting
**Risk:** Enables brute force attacks
**Recommendation:** Add rate limiting middleware

### Recommendations

1. [ ] Fix critical and high issues before next deployment
2. [ ] Schedule medium issues for next sprint
3. [ ] Add low issues to backlog
4. [ ] Re-run audit after fixes

Commands to Run

After completing the audit, provide the user with:

1. Summary of findings
2. Prioritized fix list
3. Commands to address each issue
4. Timeline recommendation