dev-security-audit

Files (6)

• SKILL.md
• README.md · references/cases/
• apifox-2026-03.md · references/cases/
• axios-2026-03.md · references/cases/
• remediation.md · references/
• scan-targets.md · references/

SKILL.md (first lines)

# Developer Workstation Security Audit

A systematic, multi-phase security audit for developer workstations. Checks for supply chain compromise indicators (via case-based IoC library at `references/cases/`), scans for exposed credentials across 20+ categories, and generates a prioritized remediation plan.

## When to Use

- User suspects their machine was compromised
- User wants to check for exposed secrets/credentials
- User heard about a supply chain attack and wants to check if affected
- User wants a general security audit of their dev environment
- Post-incident response: credential rotation planning

## When NOT to Use

- Code-level security review (use `/codex-security` or `/security-review`)
- Dependency vulnerability audit (use `/dep-audit`)
- OWASP Top 10 web app audit (use `/codex-security`)
- Runtime application security testing

## Workflow Overview

```mermaid
sequenceDiagram
    participant U as User
    participant C as Claude
    participant S as System
    C->>S: Phase 0: Supply Chain IoC Dispatch (case-driven)
    C->>S: Phase 1: Credential & Secret Exposure Scan
    C->>S: Phase 2: Application & Browser Data Scan
    C->>S: Phase 3: Persistence & Backdoor Check
    C->>U: Phase 4: Report Generation & Remediation Plan
```

Run phases sequentially. Each phase produces findings that feed into the final report. Use the reference files for detailed scan targets and IoC lists.

**Evidence preservation**: Before any cleanup or deletion, always copy/archive artifacts for forensic analysis. Never destroy evidence before the report is generated.

## Phase 0: Supply Chain IoC Dispatch

Check for known supply chain compromises using the case library (`references/cases/`). This phase is conditional — it runs only when matching cases are found.

### Dispatch Algorithm

1. **Detect platform**: macOS / Linux / Windows
2. **Load case catalog**: Read `references/cases/README.md` for active cases
3. **Scan product presence**: For each active case, check if the product is installed on the system
4. **Execute matching cases**: Load the case file and run its Detection Commands section

### Dispatch Rules

| Condition | Action |
|-----------|--------|
| No matching case (product not installed) | Skip Phase 0, proceed to Phase 1 |
| Single match | Load case file, run detection + interpretation |
| Multiple matches | Iterate: execute each case sequentially |

### Output Contract

For each matched case, report:

| Field | Description |
|-------|-------------|
| `case_id` | From case frontmatter (e.g., `PRODUCT-YYYY-MM`) |
| `status` | `COMPROMISED` / `INCONCLUSIVE` / `CLEAN` / `NOT_INSTALLED` |
| `confidence` | From case frontmatter + detection result |

If any case returns `COMPROMISED`, execute evidence preservation per case file instructions before proceeding.

## Phase 1: Credential & Secret Exposure Scan

Scan for ALL sensitive files an attacker with user-space read access could have exfiltrated. This scan reveals credential hygiene issues regardless of supply chain compromise status.

Read `references/scan-targets.md` for the complete list. Below is the execution strategy.

### Scan Strategy

Run scans in parallel where possible (use subagents for independent categories). Group into 3 parallel tracks:

**Track A — Cloud & Infrastructure Credentials:**
- AWS (`~/.aws/credentials`, `~/.aws/config`)
- GCP (`~/.config/gcloud/` — credentials.db, access_tokens.db, application_default_credentials.json)
- Azure (`~/.azure/`)
- Kubernetes (`~/.kube/config`, `~/.kube/custom-contexts/`)
- Terraform (`~/.terraform.d/credentials.tfrc.json`)
- Docker (`~/.docker/config.json`)

**Track B — Development Tool Tokens:**
- SSH keys (`~/.ssh/`)
- Git credentials (`~/.git-credentials`, `~/.gitconfig`)
- GitHub CLI (`~/.config/gh/`)
- GitLab CLI (`~/.config/glab-cli/`)
- npm (`~/.npmrc`)
- GPG keys (`~/.gnupg/private-keys-v1.d/`)

**Track C — Application Secrets & History:**
- Shell history token scan (grep for patterns below)
- `.env` files (`find ~ -maxdepth 5 \( -name ".env" -o -name ".env.*" \) 2>/dev/null | grep -v node_modules | grep -v .git`)
- Crypto wallets (Solana, Electrum, etc.)
- VPN configs (`*.ovpn`, WireGuard)

### Parallel Scan Merge Rules

| # | Rule | Description |
|---|------|-------------|
| 1 | Subagent parallel | Tracks A/B/C may run via subagents in parallel for speed |
| 2 | Unified output schema | All tracks emit: `Category \| Path \| Severity \| Redacted Sample \| Action` |
| 3 | Dedup by key | Merge results using `(Path + Indicator Type + Token Prefix)` as dedup key |
| 4 | Critical bubble-up | Critical/Critical+ findings surface immediately — do not wait for full scan |

### Token Pattern Reference

Use these regex patterns to extract tokens from shell history and .env files:

```
OpenAI:           sk-[a-zA-Z0-9_-]{20,}
Anthropic:        sk-ant-[a-zA-Z0-9_-]{20,}
GitHub Classic:   gh[posur]_[a-zA-Z0-9]{20,}
GitHub Fine-grain: github_pat_[a-zA-Z0-9_]{20,}
GitLab PAT:       glpat-[a-zA-Z0-9_-]{20,}

From sd0xdev/sd0x-harness, MIT.

More from sd0xdev/sd0x-harness