Codebase Security & Secrets Audit Skill

Run automated static security scans across files and repositories to eliminate exposed credentials, unparameterized queries, command injections, and common web security vulnerabilities before code is merged.

🛡️ The 5 Non-Negotiable Security Rules

1. Pre-Commit Scan: Never report a feature or fix complete without running a security scan on all modified files.
2. Zero Hardcoded Secrets: Secrets, JWT keys, API keys, and database passwords must NEVER be committed to source code—always verify environment variable extraction (process.env.*, os.environ[*]).
3. Always Parameterize Queries: Raw string concatenation or template literals in database queries (query(...), execute(...), raw(...)) are prohibited.
4. No Raw Shell Interpolation: Avoid child_process.exec(...) or os.system(...) with concatenated strings; use execFile or spawn with argument arrays.
5. Sanitize Dynamic HTML: Prohibit unsanitized innerHTML or dangerouslySetInnerHTML. Use textContent or DOMPurify.

⚡ Quick Scan Workflows

Method A: Via AI Mind Map MCP Tool

// Scan the entire indexed project for vulnerabilities
mindmap_security_scan({
  "severity": "high" // 'critical' | 'high' | 'medium' | 'all'
})

// Or scan a specific edited file
mindmap_security_scan({
  "filePath": "src/controllers/auth.ts",
  "severity": "all"
})

Method B: Via Standalone CLI Scanner

# Scan whole repository
node .agents/skills/codebase-security-audit/scripts/security-audit.mjs

# Scan specific file
node .agents/skills/codebase-security-audit/scripts/security-audit.mjs --file src/auth.ts

# Filter by severity
node .agents/skills/codebase-security-audit/scripts/security-audit.mjs --severity critical

🔍 Vulnerability Checks & Detection Rules

See references/vulnerability-patterns.md for full regex details and attack vectors.

✅ Self-Verification Checklist Before Merging Code

• Did you run mindmap_security_scan on all edited files?
• Are any new API keys or credentials extracted into .env.example?
• Are all database operations parameterized?
• Are shell command executions isolated to argument arrays?
• Are CORS headers restricted to trusted origins?