Security Audit

Security Audit Skill

Execute a comprehensive, end-to-end security audit on the current codebase. Inspect source code, configurations, dependencies, and environment files to identify and remediate security vulnerabilities across 19 critical checkpoints.

🎯 Scope & Objectives

When invoked (/security-audit or when asked to perform a security check), analyze the repository against the following 6 domain modules:

Module 1: Dependencies & Package Health

1. Remove Unused Packages: Identify unused npm, pip, go, or cargo dependencies and propose removal.
2. Update Dependencies: Scan for out-of-date or vulnerable package versions (npm audit, pip-audit, cargo audit, or equivalent).

Module 2: Secrets & Environment Management

3. Check Git for Secrets: Scan commit history and stage area for hardcoded keys, JWT secrets, passwords, or tokens using tools like trufflehog or regex pattern matching.
4. Hide API Keys: Verify that external API keys are excluded from source control and loaded strictly via environment variables.
5. Check Environment Variables: Audit .env.example templates to ensure sensitive defaults are not checked into Git, and verify proper runtime validation of required .env keys.
6. Check Exposed Files: Ensure sensitive files (.env, .pem, .key, id_rsa, .DS_Store, database dumps, build artifacts) are properly listed in .gitignore.

Module 3: Authentication & Access Control

7. Proper Authentication: Verify session management, token handling (HTTP-only cookies vs. local storage), and token expiration/invalidation strategies.
8. Hash Passwords Properly: Ensure password hashing uses strong, modern algorithms (e.g., Argon2id, bcrypt with cost factor ≥12, scrypt) with appropriate salts—never plain SHA-256 or MD5.
9. Check User Access: Audit Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) implementation across authorization middleware.
10. Protect Admin Routes: Verify that privileged routes and endpoints require explicitly validated administrator scopes/roles and cannot be bypassed via parameter tampering.

Module 4: API & Endpoint Protection

11. Secure API Endpoints: Ensure all public/private endpoints validate authorization headers, enforce proper HTTP verbs, and avoid mass assignment vulnerabilities.
12. Add Rate Limiting: Verify rate-limiting middleware is applied to sensitive endpoints (login, password reset, public APIs, payment routes) to prevent brute-force and DoS attacks.
13. Check CORS Settings: Inspect Cross-Origin Resource Sharing configurations to ensure wildcard origins (*) are prohibited in production setups with credentials.
14. Secure DB Access: Check for parameterized queries / ORM usage to prevent SQL/NoSQL injection, and verify database connection strings use SSL/TLS with least-privilege accounts.

Module 5: Input Handling & Frontend Security

15. Sanitize Forms: Ensure all user inputs undergo strict server-side validation and sanitization.
16. Protect Against XSS: Audit template engines, React/Vue/Svelte renders, and HTML outputs to ensure proper contextual escaping and absence of unsafe functions (e.g., dangerouslySetInnerHTML, eval(), innerHTML).

Module 6: System Configuration & Hardening

17. Disable Debug Mode: Verify debug flags, detailed stack traces, and verbose logging are disabled for production builds.
18. Add Security Headers: Ensure defensive HTTP response headers are set (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).
19. Full Security Audit Integration: Synthesize findings across all 18 rules into a consolidated risk matrix with clear severity scores (Critical, High, Medium, Low).

🛠️ Execution Instructions for Claude Code

When executing this skill:

1. Information Gathering:

   • Scan package manifests (package.json, requirements.txt, Cargo.toml, go.mod, pom.xml).
   • Inspect build configurations, .gitignore, .env templates, server entry points, and routing files.
   • Actually run the dependency-vulnerability command for whichever manifest is present — do not just describe what it might find. Match the manifest to its tool: package.json → npm audit --json (or pnpm audit / yarn audit if that lockfile is present instead), requirements.txt → pip-audit, Cargo.toml → cargo audit, go.mod → govulncheck ./.... If more than one manifest is present, run each.
   • If the matching tool isn't installed, don't skip the checkpoint silently — say so explicitly in the report (e.g., "Update Dependencies: not run, pip-audit is not installed in this environment") rather than omitting it or treating it as a pass.

2. Codebase Inspection:

   • Run pattern-matching scans for credentials and secrets across the workspace.
   • Trace authentication workflows, route protection middleware, and database queries.
   • Audit response headers and application settings.

3. Report Generation:

   • Group findings by severity (Critical, High, Medium, Low).
   • Provide concrete code references (file_path:line_number).
   • Deliver actionable code patches and remediation commands for every identified vulnerability.

📋 Output Format

Format the audit output using the following markdown structure:

# 🛡️ Security Audit Findings

## Executive Summary
- **Total Issues Found:** X
- **Risk Breakdown:** 🔴 Critical: A | 🟠 High: B | 🟡 Medium: C | 🟢 Low: D

---

## 🔴 Critical & High Vulnerabilities

### 1. [Vulnerability Title]
- **Category:** [e.g., Secrets Exposure / Module 2]
- **File:** `path/to/file.ext:42`
- **Impact:** [Brief description of real-world exploitation risk]
- **Current Code:**
  ```language
  // Problematic snippet

• Remediation:

  // Corrected snippet
  

• Remediation Command (if applicable): npm install package@latest

(Repeat per Critical/High finding.)

🟡 Medium & 🟢 Low Vulnerabilities

N. [Finding Title]

• Category: [Module reference]
• File: path/to/file.ext:line
• Impact: [Brief description]
• Recommendation: [Concrete fix, one or two lines]

(Repeat per Medium/Low finding. These may be listed more tersely than Critical/High.)

✅ Passed Checks

List checkpoints (by number, 1–19) that were inspected and found compliant, so the report shows full coverage rather than only problems.

📊 Risk Matrix

🧭 Next Steps

Ordered remediation checklist, Critical first, with the estimated effort for each (e.g., "single-line fix" vs. "requires design change").

---

## ⚠️ Ground Rules

- **Never fabricate a finding.** Every reported issue must cite a real file and line; if a checkpoint cannot be verified (no test runner, no lockfile, etc.), say so in Passed Checks / a "Not Applicable" note rather than guessing.
- **Never auto-apply fixes without being asked.** This skill reports and proposes remediation; it does not silently rewrite auth, database, or payment code. Ask before editing anything security-critical.
- **Read secrets, never print them.** When Module 2 checks turn up a real credential, report its location and redact the value in the report itself.
- **Prefer the project's existing tools.** Use whatever audit/lint tooling the repo already has configured (`npm audit`, `pip-audit`, existing ESLint security rules) before reaching for an external scanner.