Security Audit Skill

You are performing a security audit. Output a structured report — not just prose.

Step 1 — Define the scope

Ask the user (or infer) the scope:

• Diff — current uncommitted changes (default if there are uncommitted changes)
• Branch — git diff main...HEAD
• Repo — full working tree
• Path — a specific directory or file

Step 2 — Run the audit

Walk through the OWASP Top 10 (2021) categories systematically:

1. A01 Broken Access Control — missing authz checks, IDOR, path traversal
2. A02 Cryptographic Failures — weak hashing (MD5, SHA1), hardcoded keys, missing TLS
3. A03 Injection — SQL, NoSQL, OS command, LDAP, XSS — search for unparameterized string interpolation in queries, untrusted input in exec/eval
4. A04 Insecure Design — race conditions in critical flows (payments, account changes)
5. A05 Security Misconfiguration — debug=true in prod, default creds, exposed admin panels, permissive CORS
6. A06 Vulnerable Components — outdated deps with known CVEs (cross-reference package.json/requirements.txt/go.mod)
7. A07 Identification & Authentication Failures — weak password policy, missing rate-limit on login, JWT with alg=none, sessions without timeout
8. A08 Software & Data Integrity Failures — unsigned updates, insecure deserialization (pickle, YAML.load, Java ObjectInputStream)
9. A09 Logging & Monitoring Failures — sensitive data in logs, missing audit trails
10. A10 SSRF — unvalidated URL fetches that could hit internal services (169.254.169.254, localhost)

Step 3 — Look for secrets

Search for committed secrets using these patterns:

• aws_secret, AKIA[0-9A-Z]{16}, ghp_[A-Za-z0-9]{36}, sk-[A-Za-z0-9]{32,}
• password\s*=\s*['"], api[_-]?key\s*=\s*['"]
• .env, .pem, .key files that should be gitignored

Step 4 — Output the report

SECURITY AUDIT REPORT
─────────────────────
Scope:    <scope>
Files:    <N files scanned>

🔴 CRITICAL (N)
  - <file:line> — <issue> — <fix>

🟠 HIGH (N)
  - <file:line> — <issue> — <fix>

🟡 MEDIUM (N)
  - <file:line> — <issue> — <fix>

🟢 LOW (N)
  - <file:line> — <issue> — <fix>

✓ PASSED CHECKS
  - <category>: clean

When NOT to use

• Repos with no source code (docs-only)
• When the user wants a code review (use code-review instead)
• When the user wants a license scan (use license-check)

Failure modes

• ⚠️ A clean report doesn't mean the code is secure — it means these checks passed.
• ⚠️ Always recommend a real third-party scanner (Semgrep, Snyk, Trivy) for production releases.