Security Audit

Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

Steps

1. Scan for hardcoded secrets — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like:

   • password=, secret=, token=, api_key=
   • Base64-encoded credentials
   • AWS keys (AKIA...), Stripe keys (sk_live_...), GitHub tokens (ghp_...)
   • Files: .env committed to git, config.json with credentials

2. Check authentication & authorization

   • Verify all API routes check authentication before processing.
   • Ensure role-based access control is enforced server-side, not just in the UI.
   • Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).
   • Verify session tokens are HTTP-only, secure, and have reasonable expiry.

3. Check for injection vulnerabilities

   • SQL injection: look for string concatenation in SQL queries instead of parameterized queries.
   • XSS: look for dangerouslySetInnerHTML, innerHTML, or unescaped user input rendered in templates.
   • Command injection: look for exec(), eval(), child_process.exec() with user input.
   • Path traversal: check file operations for unsanitized user input in paths.

4. Review dependency security

   • Run npm audit or pip audit to check for known vulnerabilities.
   • Flag outdated dependencies with known CVEs.
   • Check for overly permissive dependency ranges.

5. Check CORS and CSP configuration

   • Verify CORS doesn't use Access-Control-Allow-Origin: * in production.
   • Check for Content Security Policy headers.
   • Verify X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security headers.

6. Review data exposure

   • Check API responses for leaking sensitive fields (password hashes, internal IDs, PII).
   • Verify error messages don't expose stack traces or internal details in production.
   • Check logging for sensitive data being written to logs.

7. Generate report — produce a summary with severity ratings (Critical / High / Medium / Low) for each finding, with the file path, line number, and recommended fix.

Notes

• This is a code review, not a penetration test. Recommend tools like npm audit, trivy, or snyk for automated scanning.
• Always check .gitignore to ensure .env, credentials, and key files are excluded.
• For comprehensive auditing, recommend the OWASP Testing Guide.