Context
- Repository: !
git rev-parse --show-toplevel 2>/dev/null || pwd
- Languages detected: !
find . -type f \( -name "*.py" -o -name "*.ts" -o -name "*.js" -o -name "*.go" -o -name "*.rb" -o -name "*.java" \) | sed 's/.*\.//' | sort | uniq -c | sort -rn | head -10
- Target: $ARGUMENTS
Task
Perform a security audit of the codebase (or the path specified in $ARGUMENTS) covering the OWASP Top 10:
A01 - Broken Access Control: Look for missing authorization checks, IDOR patterns, direct object references, insecure direct database access without ownership checks.
A02 - Cryptographic Failures: Find hardcoded secrets, API keys, passwords in source code. Check for use of weak algorithms (MD5, SHA1 for passwords, ECB mode). Look for unencrypted sensitive data in logs or responses.
A03 - Injection: Search for SQL queries built with string concatenation, unsanitized shell commands, template injection, LDAP injection, and XSS sinks.
A04 - Insecure Design: Identify missing rate limiting on auth endpoints, no CSRF protection on state-changing forms, missing input length limits.
A05 - Security Misconfiguration: Check for debug mode enabled, verbose error messages exposing internals, permissive CORS headers, default credentials in config files.
A06 - Vulnerable Components: Note any obviously outdated dependency versions or known-vulnerable packages in package.json, requirements.txt, go.mod, or Gemfile.
A07 - Authentication Failures: Look for weak session management, missing account lockout, insecure password reset flows, JWT with weak or no signature verification.
A08 - Software Integrity Failures: Check for use of untrusted CDN resources without integrity hashes, insecure deserialization of user-supplied data.
A09 - Logging Failures: Verify that authentication events are logged, that logs do not contain passwords or tokens, and that errors are logged without exposing stack traces to users.
A10 - SSRF: Find URL parameters or user-controlled values passed to HTTP clients, file readers, or DNS lookups without validation.
For each finding, read the surrounding code to confirm it is a real issue, not a false positive.
Output Format
Executive Summary
Total findings by severity. One-paragraph risk assessment.
Findings
For each vulnerability:
- ID: VULN-001, VULN-002, ...
- Category: OWASP category (e.g., A03 - Injection)
- Severity: Critical / High / Medium / Low / Informational
- File:
path/to/file.py:42
- Description: what the vulnerability is
- Evidence: the specific code snippet or pattern found
- Remediation: concrete steps to fix it
No Issues Found
List categories where no issues were detected (to show coverage).
Out of Scope
Note any areas not checked (e.g., third-party libraries, infrastructure config not present in the repo).
1---2name: security-scan3description: Scan the codebase for security vulnerabilities based on the OWASP Top 10. Use when the user asks to audit security, find vulnerabilities, check for security issues, or says "security scan", "audit this", "find security bugs".4---5
6## Context
7
8- Repository: !`git rev-parse --show-toplevel 2>/dev/null || pwd`
9- Languages detected: !`find . -type f \( -name "*.py" -o -name "*.ts" -o -name "*.js" -o -name "*.go" -o -name "*.rb" -o -name "*.java" \) | sed 's/.*\.//' | sort | uniq -c | sort -rn | head -10`
10- Target: $ARGUMENTS
11
12## Task
13
14Perform a security audit of the codebase (or the path specified in $ARGUMENTS) covering the OWASP Top 10:
15
161. **A01 - Broken Access Control**: Look for missing authorization checks, IDOR patterns, direct object references, insecure direct database access without ownership checks.
17
182. **A02 - Cryptographic Failures**: Find hardcoded secrets, API keys, passwords in source code. Check for use of weak algorithms (MD5, SHA1 for passwords, ECB mode). Look for unencrypted sensitive data in logs or responses.
19
203. **A03 - Injection**: Search for SQL queries built with string concatenation, unsanitized shell commands, template injection, LDAP injection, and XSS sinks.
21
224. **A04 - Insecure Design**: Identify missing rate limiting on auth endpoints, no CSRF protection on state-changing forms, missing input length limits.
23
245. **A05 - Security Misconfiguration**: Check for debug mode enabled, verbose error messages exposing internals, permissive CORS headers, default credentials in config files.
25
266. **A06 - Vulnerable Components**: Note any obviously outdated dependency versions or known-vulnerable packages in `package.json`, `requirements.txt`, `go.mod`, or `Gemfile`.
27
287. **A07 - Authentication Failures**: Look for weak session management, missing account lockout, insecure password reset flows, JWT with weak or no signature verification.
29
308. **A08 - Software Integrity Failures**: Check for use of untrusted CDN resources without integrity hashes, insecure deserialization of user-supplied data.
31
329. **A09 - Logging Failures**: Verify that authentication events are logged, that logs do not contain passwords or tokens, and that errors are logged without exposing stack traces to users.
33
3410. **A10 - SSRF**: Find URL parameters or user-controlled values passed to HTTP clients, file readers, or DNS lookups without validation.
35
36For each finding, read the surrounding code to confirm it is a real issue, not a false positive.
37
38## Output Format
39
40### Executive Summary
41Total findings by severity. One-paragraph risk assessment.
42
43### Findings
44
45For each vulnerability:
46- **ID**: VULN-001, VULN-002, ...
47- **Category**: OWASP category (e.g., A03 - Injection)
48- **Severity**: Critical / High / Medium / Low / Informational
49- **File**: `path/to/file.py:42`
50- **Description**: what the vulnerability is
51- **Evidence**: the specific code snippet or pattern found
52- **Remediation**: concrete steps to fix it
53
54### No Issues Found
55List categories where no issues were detected (to show coverage).
56
57### Out of Scope
58Note any areas not checked (e.g., third-party libraries, infrastructure config not present in the repo).
aibot88