audit-security

Files (1)

• SKILL.md

SKILL.md (first lines)

TODAY=!`date +%Y-%m-%d`

# Security Audit

Scans your own code for vulnerabilities — distinct from `/audit-dependencies` which covers external packages.
Covers hardcoded secrets, injection patterns, missing authentication and authorization checks, insecure defaults, and other OWASP-class issues.
Produces a prioritized remediation plan with severity ratings.

## Prerequisites

- Working directory is the root of the repository
- Optional: `$1` — path to limit the scan (defaults to `.`)
- Language-specific tools (degrades to rg heuristics if unavailable):
  - Any language: `semgrep` (`pip install semgrep` or `brew install semgrep`)
  - Secrets: `trufflehog` (`pip install trufflehog`) or `gitleaks` (`brew install gitleaks`)
  - Python: `bandit` (`uv tool install bandit`)
  - JavaScript/TypeScript: `eslint` with `eslint-plugin-security`
  - Go: `gosec` (`go install github.com/securego/gosec/v2/cmd/gosec@latest`)

## Vulnerability Categories

| Category | Severity | Examples |
|----------|----------|---------|
| Hardcoded secrets | 🔴 Critical | API keys, passwords, tokens in source |
| Injection | 🔴 Critical | SQL, command, LDAP, XPath injection |
| Insecure deserialization | 🔴 Critical | `pickle.loads`, `eval`, `exec` on user input |
| Broken authentication | 🔴 High | Missing auth checks, weak session handling |
| Sensitive data exposure | 🔴 High | PII/secrets logged, transmitted unencrypted |
| Insecure direct object reference | 🟡 High | Missing ownership checks on resource access |
| Security misconfiguration | 🟡 Medium | Debug mode on, permissive CORS, weak TLS |
| Missing authorization | 🟡 Medium | Authenticated but not authorized |
| Cryptography issues | 🟡 Medium | Weak algorithms (MD5, SHA1), hardcoded IVs |
| Dependency confusion | 🟢 Low | Internal package names resolvable publicly |

## Steps

### 1. Detect Language and Available Tools

```
find ${1:-.} -type f | sed 's/.*\.//' | sort | uniq -c | sort -rn | head -10
command -v semgrep && semgrep --version
command -v bandit && bandit --version
command -v gosec && gosec --version
command -v gitleaks && gitleaks version
command -v trufflehog && trufflehog --version
```

### 2. Scan for Hardcoded Secrets

**gitleaks (preferred — scans git history too):**
```
gitleaks detect --source ${1:-.} --report-format json --report-path .gitleaks-report.json 2>/dev/null
cat .gitleaks-report.json 2>/dev/null | python3 -c "import json,sys; [print(f['RuleID'], f['File'], f['StartLine']) for f in json.load(sys.stdin)]" 2>/dev/null
```

**trufflehog:**
```
trufflehog filesystem ${1:-.} --json 2>/dev/null | head -50
```

**rg fallback:**
```
rg -n -i --hidden "(password|secret|api_key|apikey|token|private_key)\s*=\s*['\"][^'\"]{8,}" \
  -g '*.py' -g '*.js' -g '*.ts' -g '*.go' -g '*.env*' \
  ${1:-.} | rg -v "test|spec|mock|example|placeholder|your_" | head -30
```

Also check for secrets accidentally committed in config files:
```
rg -n -i "(password|secret|token|key)\s*:\s*['\"]?[A-Za-z0-9+/]{16,}" \
  -g '*.{yaml,yml,json,toml}' \
  ${1:-.} | rg -v "test|example|template" | head -20
```

### 3. Run Language-Specific Scanners

**Python — bandit:**
```
bandit -r ${1:-.} -f json -o .bandit-report.json 2>/dev/null
bandit -r ${1:-.} -ll 2>/dev/null | tail -40
```

**JavaScript/TypeScript — semgrep with security ruleset:**
```
semgrep --config=p/javascript --config=p/typescript --json --output .semgrep-report.json ${1:-.} 2>/dev/null
```

**Go — gosec:**
```
gosec -fmt=json -out=.gosec-report.json ./... 2>/dev/null
gosec -severity medium ./... 2>/dev/null | tail -40
```

**Any language — semgrep OWASP ruleset:**
```
semgrep --config=p/owasp-top-ten --config=p/secrets --json --output .semgrep-owasp.json ${1:-.} 2>/dev/null
```

### 4. Check for Injection Vulnerabilities

**SQL injection:**
```
rg -n '(execute|query|cursor\.execute|db\.query)\s*\(\s*[f"'"'"']|\.format\s*\(' \
  -g '*.{py,js,ts,go}' ${1:-.} | rg -i "select|insert|update|delete|where" | head -20
```

**Command injection:**
```
rg -n "(os\.system|subprocess\.(call|run|Popen)|exec\(|eval\(|child_process)" \
  -g '*.{py,js,ts}' ${1:-.} | rg -v "shell=False|#" | head -20
```

**Insecure deserialization:**
```
rg -n "(pickle\.loads|yaml\.load\s*\([^,)]+\)|eval\s*\(|exec\s*\()" \
  -g '*.py' ${1:-.} | rg -v "yaml\.safe_load|#" | head -20
```

### 5. Check Authentication and Authorization

From tomzx/agents, MIT.

More from tomzx/agents