security-audit

Files (2)

• SKILL.md
• reference.md · references/

SKILL.md (first lines)

# Security Audit Skill

- [Security Audit Skill](#security-audit-skill)
  - [Overview](#overview)
  - [Investigation Items](#investigation-items)
    - [1. External Communication Check](#1-external-communication-check)
    - [2. Data Persistence and Storage](#2-data-persistence-and-storage)
    - [3. Third-Party Libraries](#3-third-party-libraries)
    - [4. PWA/Service Worker](#4-pwaservice-worker)
    - [5. Other Security Risks](#5-other-security-risks)
  - [Execution Steps](#execution-steps)
    - [Step 1: Codebase Exploration](#step-1-codebase-exploration)
    - [Step 2: Pattern Search](#step-2-pattern-search)
    - [Step 3: Detailed File Analysis](#step-3-detailed-file-analysis)
    - [Step 4: Report Generation](#step-4-report-generation)
  - [Risk Level Definitions](#risk-level-definitions)
  - [Best Practices](#best-practices)
  - [Output Format](#output-format)
  - [References](#references)
  - [Notes](#notes)

## Overview

This skill comprehensively investigates the security of a repository, checking for any unintended external communications or data retention that the user may not be aware of.

## Investigation Items

### 1. External Communication Check
- Usage of network APIs (fetch, XMLHttpRequest, WebSocket)
- Data transmission to external services
- Presence of analytics or tracking code
- Investigation of HTTP/HTTPS communications

### 2. Data Persistence and Storage
- Usage of localStorage, IndexedDB, and Cookies
- What data is being stored
- Handling of personal information and sensitive data
- Confirmation of data retention policies

### 3. Third-Party Libraries
- Dependency analysis of package.json
- Detection of suspicious external libraries
- Library trustworthiness evaluation
- Known vulnerability checks

### 4. PWA/Service Worker
- Service Worker behavior and content
- Cache strategy verification
- Background process investigation
- Offline behavior analysis

### 5. Other Security Risks
- eval and dangerous dynamic code execution
- XSS vulnerability possibilities
- SQL injection
- Command injection
- Path traversal
- Risk of data exfiltration
- Security of child process execution
- Safety of environment variable access

## Execution Steps

### Step 1: Codebase Exploration

Use the Task tool with the Explore agent to investigate:

```
- Search for external communication-related code
- Usage of data storage-related APIs
- Dependency analysis of package.json
- Detection of security risk patterns
```

### Step 2: Pattern Search

Use the Grep tool to search for the following patterns:

**External Communications:**
- `fetch(`
- `XMLHttpRequest`
- `WebSocket`
- `axios`
- `http.get`
- `https.request`

**Data Storage:**
- `localStorage`
- `sessionStorage`
- `indexedDB`
- `openDatabase`
- `cookie`
- `Dexie`

**Dangerous Code:**
- `eval(`
- `Function(`
- `exec(`
- `spawn(`
- `child_process`
- `innerHTML`
- `dangerouslySetInnerHTML`

### Step 3: Detailed File Analysis

Read detected files using the Read tool to confirm context:

- Actual purpose of usage
- Handling of user input
- Implementation status of security measures
- Potential risk assessment

### Step 4: Report Generation

Create a report in the following format:

```markdown
## Security Audit Report

From hidao80/ai-agent-plugins, MIT.

More from hidao80/ai-agent-plugins