# Securify > Scan a repository for security vulnerabilities across dependencies, code, secrets, and API surface - Skill: `aibot88/securify` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add aibot88/securify` - Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/securify/raw - Safety review: pending (external: skill-scanner PASS, skillspector CAUTION) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: aibot88 (https://skillmd.com/u/aibot88) - Updated: 2026-09-09 - Page: https://skillmd.com/skills/aibot88/securify --- You are being invoked via the /securify skill. Your task is to perform a comprehensive security audit of the current repository, identify vulnerabilities, and produce an actionable report. You must also specifically assess API security posture. ## Overview This skill covers: 1. Detect project type and languages 2. Scan dependencies for known CVEs 3. Audit code for OWASP Top 10 and common security anti-patterns 4. Check API endpoints for authentication, authorization, and input validation gaps 5. Detect hardcoded secrets and credentials 6. Review security-related configuration files 7. Generate a prioritized vulnerability report with remediation guidance --- ## Step 1 — Detect Project Type Identify all languages and frameworks in use by checking for: - `package.json` → Node.js / TypeScript - `requirements.txt` / `pyproject.toml` / `Pipfile` → Python - `go.mod` → Go - `Cargo.toml` → Rust - `pom.xml` / `build.gradle` → Java / Kotlin - `Gemfile` → Ruby - `*.csproj` → C# / .NET Note all detected stacks — a repo may have multiple (e.g. a Node.js frontend + Python backend). --- ## Step 2 — Dependency Vulnerability Scan Run the appropriate dependency scanner for each detected stack. Do NOT skip this step. ### Node.js ```bash npm audit --json 2>/dev/null || yarn audit --json 2>/dev/null ``` Parse the output and list packages with severity: `critical`, `high`, `moderate`, `low`. ### Python ```bash pip-audit --format=json 2>/dev/null || safety check --json 2>/dev/null ``` If neither is installed, fall back to: ```bash pip list --format=json | python3 -c "import sys,json; pkgs=json.load(sys.stdin); print('\n'.join(f'{p[\"name\"]}=={p[\"version\"]}' for p in pkgs))" ``` and note that pip-audit/safety should be installed for full scanning. ### Go ```bash govulncheck ./... 2>/dev/null ``` If not available: ```bash go list -m all 2>/dev/null ``` and recommend installing `govulncheck`. ### Rust ```bash cargo audit 2>/dev/null ``` ### Ruby ```bash bundle audit check --update 2>/dev/null ``` ### Java Check for known vulnerable versions of common dependencies in `pom.xml` or `build.gradle` (Log4Shell, Spring4Shell, etc.). For each vulnerability found, record: - Package name and version - CVE ID (if available) - Severity: CRITICAL / HIGH / MEDIUM / LOW - Description - Fixed version (if available) --- ## Step 3 — Secret and Credential Detection Search the entire repository (excluding `.git/`) for accidentally committed secrets. ### Patterns to search for (use Grep): **API Keys and tokens:** ``` (api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9\-_]{16,} (secret[_-]?key|secret)\s*[:=]\s*['"]?[A-Za-z0-9\-_]{16,} (access[_-]?token|auth[_-]?token)\s*[:=]\s*['"]?[A-Za-z0-9\-_\.]{16,} Bearer\s+[A-Za-z0-9\-_\.]{20,} ``` **Cloud provider credentials:** ``` AKIA[0-9A-Z]{16} # AWS Access Key ID (?i)aws.{0,20}secret.{0,20}['\"][0-9a-zA-Z/+]{40} # AWS Secret AIza[0-9A-Za-z\-_]{35} # Google API Key [0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com # Google OAuth sk-[a-zA-Z0-9]{48} # OpenAI API Key ghp_[a-zA-Z0-9]{36} # GitHub Personal Access Token ghs_[a-zA-Z0-9]{36} # GitHub App Token ``` **Database connection strings:** ``` (mongodb|postgres|postgresql|mysql|redis):\/\/[^:]+:[^@]+@ DATABASE_URL\s*=\s*['"]?[^\s'"]+ ``` **Private keys:** ``` -----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY----- ``` **Passwords:** ``` password\s*[:=]\s*['"][^'"]{8,}['"] passwd\s*[:=]\s*['"][^'"]{8,}['"] ``` For each match, record: - File path and line number - Type of secret detected - Severity: CRITICAL (private keys, cloud credentials) / HIGH (API keys, tokens) / MEDIUM (passwords in config) Check `.gitignore` to confirm `.env` files are excluded. If not, flag it. --- ## Step 4 — API Security Audit Find all API route definitions using Grep. Then for each route, evaluate the security controls below. ### 4a. Locate API Routes Search for route definitions matching the detected framework: **Express/Fastify/Koa (Node.js):** ``` (app|router)\.(get|post|put|patch|delete|all)\s*\( ``` **FastAPI/Flask (Python):** ``` @(app|router)\.(get|post|put|patch|delete)\( ``` **Go (Gin/Echo/Chi/Fiber):** ``` \.(GET|POST|PUT|PATCH|DELETE|Any)\s*\( ``` **Rails:** ``` (get|post|put|patch|delete)\s+['"]\/ resources\s+: ``` ### 4b. For Each Route, Check: #### Authentication - Does the route have an auth middleware/guard/decorator? - Express: `authMiddleware`, `authenticate`, `verifyToken`, `requireAuth`, `passport.authenticate` - FastAPI: `Depends(get_current_user)`, `Security(...)` - NestJS: `@UseGuards(AuthGuard)`, `@UseGuards(JwtAuthGuard)` - Go: middleware chain applied before handler - Flag any route that handles sensitive data (user info, payments, admin) without authentication #### Authorization - After authentication, is there authorization (RBAC/ABAC)? - Look for: role checks, permission checks, `hasRole()`, `can()`, `@Roles()`, `@RequirePermission()` - Flag routes that allow any authenticated user to access admin/privileged resources without role checks #### Input Validation - Is request body/query/path input validated? - Express: `express-validator`, `joi`, `zod`, `yup` - FastAPI: Pydantic models - Go: binding tags `binding:"required"`, `validate:"..."` - NestJS: `class-validator` DTOs - Flag routes that read `req.body`, `request.json()`, or query params without validation #### Rate Limiting - Is there a rate limiter applied globally or per-route? - Express: `express-rate-limit`, `rate-limiter-flexible` - FastAPI: `slowapi` - Go: `tollbooth`, `golang.org/x/time/rate` - Flag public auth endpoints (`/login`, `/register`, `/forgot-password`) without rate limiting #### CORS - Check CORS configuration: - Is `origin: '*'` used in production (over-permissive)? - Are credentials (`withCredentials`) allowed with wildcard origin? - Look for: `cors()`, `CORSMiddleware`, `Access-Control-Allow-Origin` #### HTTPS / TLS - Are there any HTTP redirects to HTTPS? - Is HSTS configured? - Look for: `helmet()`, security headers, `SECURE_SSL_REDIRECT` #### SQL Injection - Search for raw query string concatenation: ``` query\s*[+]=?\s*.*req\.(body|params|query) execute\s*\(\s*f['"]\s*SELECT cursor\.execute\s*\(\s*['"].*%s.*%.*request db\.raw\s*\(.*\+ ``` - Flag any parameterized query bypass patterns #### Command Injection - Search for dangerous subprocess calls with user input: ``` exec\s*\(.*req\.(body|params|query) subprocess\.(run|call|Popen).*request os\.system\s*\(.*input child_process\.exec\s*\(.*req ``` #### Path Traversal - Search for file system operations with user-controlled paths: ``` fs\.(readFile|writeFile|readdir)\s*\(.*req\.(body|params|query) open\s*\(.*request\.(form|args|json) ``` #### XSS (for server-side rendering) - Search for unescaped user input in templates: ``` innerHTML\s*=\s*.*req dangerouslySetInnerHTML render_template_string\s*\(.*request ``` ### 4c. Summarize API Security Findings For each finding, note: - Route: `POST /api/auth/login` - Issue: Missing rate limiting - Severity: HIGH - File: `src/routes/auth.ts:42` - Recommendation: Apply `express-rate-limit` with max 5 attempts per 15 minutes --- ## Step 5 — Security Configuration Review Check for insecure security-related configuration: ### Environment Variables - Is there a `.env.example` present? If not, flag it. - Are any sensitive defaults set in `.env.example` (e.g., `SECRET_KEY=mysecretkey`)? ### Security Headers - Is `helmet` (Node.js), `django-csp`, or equivalent used? - Are the following headers set? - `Content-Security-Policy` - `X-Frame-Options` - `X-Content-Type-Options` - `Strict-Transport-Security` - `Referrer-Policy` ### Session Configuration - Is session secret a hardcoded weak string? - Are cookies set with `httpOnly: true`, `secure: true`, `sameSite: 'strict'`? ### JWT Configuration - Are JWTs using `HS256` with a weak/hardcoded secret? (Should use RS256 or strong HS256 secret) - Is token expiry set (missing `expiresIn` is a vulnerability)? - Is `jwt.verify()` used (not just `jwt.decode()` which skips verification)? ### Docker / Container - Is the app running as root in Docker? (Look for `USER` directive in Dockerfile) - Are secrets passed as `ARG` or `ENV` in Dockerfile (leaked in image layers)? ### Dependencies - Is `package-lock.json` / `yarn.lock` / `poetry.lock` committed? (Ensures reproducible, auditable builds) --- ## Step 6 — Generate Vulnerability Report Create the file `docs/SECURITY_AUDIT.md` with the following structure: ```markdown # Security Audit Report **Generated:** **Repository:** **Audited By:** /securify skill --- ## Executive Summary | Severity | Count | |----------|-------| | 🔴 CRITICAL | X | | 🟠 HIGH | X | | 🟡 MEDIUM | X | | 🔵 LOW | X | | **Total** | **X** | --- ## 1. Dependency Vulnerabilities ### CRITICAL #### [Package Name] vX.Y.Z — CVE-XXXX-XXXX - **Description:** Brief description of the vulnerability - **Fix:** Upgrade to vX.Y.Z - **Command:** `npm update package-name` or `pip install --upgrade package-name` ### HIGH ... ### MEDIUM ... --- ## 2. Secrets & Credentials Found ### CRITICAL — Hardcoded Private Key - **File:** `config/server.key:1` - **Issue:** RSA private key committed to repository - **Action:** Remove immediately, rotate the key, add to `.gitignore` ### HIGH — API Key Exposed - **File:** `src/config.js:12` - **Issue:** API key hardcoded in source file - **Action:** Move to environment variable, invalidate and regenerate the key --- ## 3. API Security Issues ### Authentication Gaps #### 🔴 CRITICAL — Admin Endpoint Without Authentication - **Route:** `DELETE /api/admin/users/:id` - **File:** `src/routes/admin.ts:78` - **Issue:** No authentication middleware applied - **Fix:** Add auth guard before handler #### 🟠 HIGH — Missing Rate Limiting on Auth Endpoints - **Routes:** `POST /api/auth/login`, `POST /api/auth/forgot-password` - **Issue:** No rate limiting — vulnerable to brute force attacks - **Fix:** ```javascript const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 }); router.post('/auth/login', loginLimiter, loginHandler); ``` #### 🟡 MEDIUM — Overly Permissive CORS - **File:** `src/app.ts:15` - **Issue:** `origin: '*'` allows any domain to make requests - **Fix:** Specify allowed origins explicitly: ```javascript cors({ origin: ['https://yourdomain.com'] }) ``` ### Input Validation Gaps #### 🟠 HIGH — SQL Injection Risk - **File:** `src/db/queries.ts:34` - **Issue:** User input concatenated into raw SQL query - **Fix:** Use parameterized queries: ```javascript // UNSAFE: db.query(`SELECT * FROM users WHERE id = ${req.params.id}`) // SAFE: db.query('SELECT * FROM users WHERE id = $1', [req.params.id]) ``` ### Authorization Issues #### 🟠 HIGH — Missing Role Check on Admin Route - **Route:** `GET /api/admin/stats` - **File:** `src/routes/admin.ts:12` - **Issue:** Route is authenticated but any user can access admin data - **Fix:** Add role check middleware --- ## 4. Security Configuration Issues ### 🟡 MEDIUM — Security Headers Not Set - **Issue:** No `helmet` or equivalent security headers middleware - **Fix:** ```javascript import helmet from 'helmet'; app.use(helmet()); ``` ### 🔵 LOW — Cookies Missing Security Flags - **File:** `src/session.ts:8` - **Issue:** Session cookies not set with `httpOnly` and `secure` flags - **Fix:** ```javascript cookie: { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'strict' } ``` --- ## 5. Recommended Next Steps ### Immediate Actions (CRITICAL) 1. [ ] Rotate any exposed secrets/API keys immediately 2. [ ] Add authentication to unprotected admin endpoints 3. [ ] Remove hardcoded credentials from source code ### Short-term (HIGH) 1. [ ] Add rate limiting to all authentication endpoints 2. [ ] Fix SQL injection vulnerabilities with parameterized queries 3. [ ] Upgrade vulnerable dependencies ### Medium-term (MEDIUM/LOW) 1. [ ] Add `helmet` for security headers 2. [ ] Restrict CORS to known origins 3. [ ] Configure secure cookie flags 4. [ ] Set up automated dependency scanning in CI --- ## 6. Automated Security Tools to Add Based on this project's stack, consider adding these tools: ### Dependency Scanning (CI) ```yaml # .github/workflows/security.yml - name: Dependency audit run: npm audit --audit-level=high ``` ### Static Analysis - **Node.js:** `eslint-plugin-security`, `semgrep` - **Python:** `bandit`, `semgrep` - **Go:** `gosec` - **Rust:** `cargo-audit` ### Secret Scanning ```yaml - name: Secret scan uses: trufflesecurity/trufflehog@main with: path: ./ base: main ``` --- *This report was generated automatically by the /securify skill. Manual review is recommended for complex logic vulnerabilities.* ``` --- ## Step 7 — Add Security CI Workflow Create or update `.github/workflows/security.yml` with appropriate security scanning jobs: ```yaml name: Security Scan on: push: branches: [main, master] pull_request: branches: [main, master] schedule: - cron: '0 6 * * 1' # Weekly on Monday at 6am jobs: dependency-audit: name: Dependency Vulnerability Scan runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: '20' - run: npm ci - run: npm audit --audit-level=high secret-scan: name: Secret Detection runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@main with: path: ./ base: ${{ github.event.repository.default_branch }} head: HEAD extra_args: --only-verified sast: name: Static Analysis runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Semgrep SAST uses: returntocorp/semgrep-action@v1 with: config: >- p/security-audit p/owasp-top-ten p/jwt p/sql-injection ``` Only create this file if `.github/workflows/` already exists or the user has a GitHub Actions setup. Otherwise, note it as a recommendation. --- ## Step 8 — Update CLAUDE.md Add a security workflow section to `CLAUDE.md` (only if CLAUDE.md exists): ```markdown ### Security Auditing - Use the `/securify` skill to scan for vulnerabilities before major releases or when adding new API endpoints - Run `/securify` after adding new dependencies to check for known CVEs - Never commit `.env` files or hardcoded secrets — use environment variables - Ensure all API endpoints have authentication and rate limiting where appropriate - Review `docs/SECURITY_AUDIT.md` for outstanding security issues ``` --- ## Step 9 — Final Summary After completing all steps, output a concise summary to the user: ``` Security Audit Complete ======================= Repository: Stack detected: Findings: 🔴 CRITICAL X issues 🟠 HIGH X issues 🟡 MEDIUM X issues 🔵 LOW X issues Top priorities: 1. 2. 3. Full report: docs/SECURITY_AUDIT.md Recommended tools to install: - for ``` --- ## Important Notes - **Do NOT modify any source code** — only report findings and suggest fixes - **Do NOT expose or print full secret values** — truncate to first 4 and last 4 characters when referencing found secrets (e.g., `sk-ab...xy12`) - Flag when `.env` is missing from `.gitignore` - Prioritize API endpoint security findings since exposed APIs are the primary attack surface - If no vulnerabilities are found in a category, explicitly state "No issues found" for clarity - When tools like `pip-audit`, `govulncheck`, or `cargo audit` are not installed, note it in the report and include install instructions