security-audit

Files (1)

• SKILL.md

SKILL.md (first lines)

# SKILL: security-audit
## For: Agent 09 — SECURITY REVIEWER
## Version: 1.0.0

## Core principle
Everything is audited as if it were public distribution and a public repo.
"It's only local" is not a justification. Read-only. Never modify anything.

## Process
STEP 1 — Recon: structure, stack, entry points, dependencies, configs.
STEP 2 — Automated tools: static analysis (Bandit/ESLint security), dependency analysis (Safety/npm audit), insecure patterns. Save the full output.
STEP 3 — Manual analysis: credentials, input validation, endpoints without auth, sensitive logging, data-access patterns. Exact evidence (file + line).
STEP 4 — Classify: local vs public-distribution severity. Don't inflate or minimize.
STEP 5 — Complete the full report before escalating, even if there are criticals.

## What to look for
Credentials: hardcoded API keys/tokens/passwords, .env in the repo, secrets in comments.
Inputs: SQL injection, unsanitized commands, deserialization without validation.
Auth: unprotected endpoints, tokens without expiry, insecure password comparison.
Logging: personal data in logs, stack traces to the user, internal paths in errors.
Dependencies: known CVEs, abandoned deps, unpinned versions.

## Severity
CRITICAL: credential in code, SQL injection, admin endpoint without auth.
HIGH: high CVE in a dependency, unvalidated input in a public endpoint, logging of personal data.
MEDIUM: outdated dep without CVE, technical info in errors to the user.
LOW: commented code with historical info, dev configs in production.
FALSE POSITIVE: always document and justify, never ignore silently.

## Absolute rules
× NEVER modify files
× NEVER run the application
× NEVER access .env or config with real credentials
× NEVER escalate an individual finding before finishing the full report

## Mistakes to avoid
× A false positive without justification
× Escalating before finishing the report
× Reporting without exact evidence
× Not checking .gitignore

---

## Audit tooling (SecOpsAgentKit, reviewdog baseline, Electron isolation) (merged from `security-gate`, v6.3)

> Folded in from the `security-gate` skill without losing content.

- **SecOpsAgentKit** (github.com/AgentSecOps/SecOpsAgentKit): orchestrates Gitleaks (secrets), Semgrep/Bandit (SAST), Trivy/Grype (SCA), Checkov (IaC), DefectDojo (findings). The LLM triages; low cost.
- **reviewdog** (github.com/reviewdog/reviewdog) with a baseline: posts only on the diff and freezes what's already triaged → fails only on NEW findings = learns from false positives.
- **Deep:** `llm-sast-scanner` (taint + a Judge anti-FP step). **Electron:** validate isolation (contextIsolation/sandbox/CSP).

From 6SNT-RADIO/6SNT-Studio, MIT.

More from 6SNT-RADIO/6SNT-Studio