Security Scan Skill

Catches security issues before they reach production. Returns a severity-ranked report with specific remediations.

When to Activate

Activate:

• Before merging any PR that touches auth, data access, or API routes
• Before every production deployment
• When adding new dependencies
• When changing environment variable handling

Core Principles

• Security takes priority over convenience
• Every finding includes a specific remediation
• CRITICAL or HIGH = must fix before merge
• No exceptions without documented risk acceptance

Workflow

1. Check for hardcoded secrets (grep patterns)
2. Check for injection vulnerabilities (SQL, command, template)
3. Verify auth middleware on protected routes
4. Check input validation at API boundaries
5. Run npm audit --audit-level=moderate
6. Review sensitive data in logs
7. Produce verdict

OWASP Top 10 Quick Reference

Scan Commands

# Dependency vulnerabilities
npm audit --audit-level=moderate

# Hardcoded secrets (grep patterns)
grep -r "password\s*=\s*['\"]" src/ --include="*.ts"
grep -r "api_key\s*=\s*['\"]" src/ --include="*.ts"
grep -r "secret\s*=\s*['\"]" src/ --include="*.ts"

# SQL string concatenation
grep -r "query\`.*\${" src/ --include="*.ts"
grep -rn "query.*+.*req\." src/ --include="*.ts"

Output Format

## Security Scan Report

### 🔴 Critical
| # | File | Line | Issue | Remediation |
|---|------|------|-------|-------------|

### 🟠 High
| # | File | Line | Issue | Remediation |
|---|------|------|-------|-------------|

### 🟡 Medium
| # | File | Line | Issue | Remediation |
|---|------|------|-------|-------------|

### Dependencies
- npm audit: 0 critical, 0 high, 2 moderate (tracked)

### Verdict: PASS ✅ | FAIL ❌ | PASS_WITH_NOTES ⚠️

FAIL if any Critical or High findings.
PASS_WITH_NOTES if only Medium or Low findings.