security-audit-pro

Files (1)

• SKILL.md

SKILL.md (first lines)

# Security Audit Pro — Comprehensive Security Review

Use this skill for professional-grade security auditing. Covers SAST, SCA, container security, SBOM, PII detection, and compliance patterns. Used by Themis during code review.

---

## Scope

This skill replaces and expands the basic `security-audit` skill. It covers:

| Domain | Coverage |
|--------|----------|
| **SAST** | SQL injection, XSS, CSRF, path traversal, command injection |
| **SCA** | Dependencies with known CVEs, outdated packages |
| **Container** | Non-root user, health checks, secrets, minimal base images |
| **SBOM** | Software Bill of Materials generation |
| **PII** | Detection of personal data in code/logs |
| **Compliance** | GDPR, LGPD, HIPAA patterns |

---

## SAST — Static Application Security Testing

### SQL Injection

**❌ Vulnerable:**
```python
query = f"SELECT * FROM users WHERE email = '{email}'"
await db.execute(query)
```

**✅ Safe:**
```python
query = text("SELECT * FROM users WHERE email = :email")
await db.execute(query, {"email": email})
```

### XSS (Cross-Site Scripting)

**❌ Vulnerable:**
```python
return HTMLResponse(content=f"<h1>Welcome, {user.name}</h1>")
```

**✅ Safe:**
```python
from markupsafe import escape
return HTMLResponse(content=f"<h1>Welcome, {escape(user.name)}</h1>")
```

### CSRF

**Check:**
- [ ] CSRF tokens on state-changing endpoints
- [ ] SameSite cookie attribute set
- [ ] Origin/Referer header validation

### Path Traversal

**❌ Vulnerable:**
```python
file_path = f"/uploads/{filename}"
return FileResponse(file_path)
```

**✅ Safe:**
```python
import os
base_dir = "/uploads"
file_path = os.path.join(base_dir, os.path.basename(filename))
if not file_path.startswith(base_dir):
    raise HTTPException(400, "Invalid path")
return FileResponse(file_path)
```

### Command Injection

**❌ Vulnerable:**
```python
os.system(f"convert {input_file} {output_file}")
```

**✅ Safe:**
```python
import subprocess
subprocess.run(["convert", input_file, output_file], check=True)
```

---

## SCA — Software Composition Analysis

### Dependency Audit

Run these commands to check for vulnerabilities:

```bash
# Python
pip-audit -r requirements.txt
safety check -r requirements.txt

# Node.js
npm audit
npx audit-ci --moderate
```

### Common Vulnerable Patterns

| Pattern | Risk | Fix |
|---------|------|-----|
| `requests < 2.31.0` | CVE-2023-32681 | Upgrade to >= 2.31.0 |
| `pydantic < 2.0` | Validation bypass | Upgrade to >= 2.7 |
| `sqlalchemy < 2.0` | SQL injection risk | Upgrade to >= 2.0 |
| `express < 4.18.2` | Open redirect | Upgrade to >= 4.18.2 |

---

## Container Security

From ils15/pantheon-legacy, MIT.

More from ils15/pantheon-legacy