Security Audit

@'

name: security-audit description: Audits codebases for security vulnerabilities, secrets exposure, auth risks, dependency health, and misconfigurations. version: 1.0.0 author: software-engineering tags: [security, audit, devsecops, claude-code]

Security Audit Skill

Execute a comprehensive, end-to-end security audit on the current codebase. Inspect source code, configurations, dependencies, and environment files to identify and remediate security vulnerabilities across 19 critical checkpoints.

🎯 Scope & Objectives

When invoked (/security-audit or when asked to perform a security check), analyze the repository against the following 6 domain modules:

Module 1: Dependencies & Package Health

1. Remove Unused Packages: Identify unused npm, pip, go, or cargo dependencies and propose removal.
2. Update Dependencies: Scan for out-of-date or vulnerable package versions (npm audit, pip-audit, cargo audit, or equivalent).

Module 2: Secrets & Environment Management

3. Check Git for Secrets: Scan commit history and stage area for hardcoded keys, JWT secrets, passwords, or tokens using tools like trufflehog or regex pattern matching.
4. Hide API Keys: Verify that external API keys are excluded from source control and loaded strictly via environment variables.
5. Check Environment Variables: Audit .env.example templates to ensure sensitive defaults are not checked into Git, and verify proper runtime validation of required .env keys.
6. Check Exposed Files: Ensure sensitive files (.env, .pem, .key, id_rsa, .DS_Store, database dumps, build artifacts) are properly listed in .gitignore.

Module 3: Authentication & Access Control

7. Proper Authentication: Verify session management, token handling (HTTP-only cookies vs. local storage), and token expiration/invalidation strategies.
8. Hash Passwords Properly: Ensure password hashing uses strong, modern algorithms (e.g., Argon2id, bcrypt with cost factor ≥12, scrypt) with appropriate salts—never plain SHA-256 or MD5.
9. Check User Access: Audit Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) implementation across authorization middleware.
10. Protect Admin Routes: Verify that privileged routes and endpoints require explicitly validated administrator scopes/roles and cannot be bypassed via parameter tampering.

Module 4: API & Endpoint Protection

11. Secure API Endpoints: Ensure all public/private endpoints validate authorization headers, enforce proper HTTP verbs, and avoid mass assignment vulnerabilities.
12. Add Rate Limiting: Verify rate-limiting middleware is applied to sensitive endpoints (login, password reset, public APIs, payment routes) to prevent brute-force and DoS attacks.
13. Check CORS Settings: Inspect Cross-Origin Resource Sharing configurations to ensure wildcard origins (*) are prohibited in production setups with credentials.
14. Secure DB Access: Check for parameterized queries / ORM usage to prevent SQL/NoSQL injection, and verify database connection strings use SSL/TLS with least-privilege accounts.

Module 5: Input Handling & Frontend Security

15. Sanitize Forms: Ensure all user inputs undergo strict server-side validation and sanitization.
16. Protect Against XSS: Audit template engines, React/Vue/Svelte renders, and HTML outputs to ensure proper contextual escaping and absence of unsafe functions (e.g., dangerouslySetInnerHTML, eval(), innerHTML).

Module 6: System Configuration & Hardening

17. Disable Debug Mode: Verify debug flags, detailed stack traces, and verbose logging are disabled for production builds.
18. Add Security Headers: Ensure defensive HTTP response headers are set (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).
19. Full Security Audit Integration: Synthesize findings across all 18 rules into a consolidated risk matrix with clear severity scores (Critical, High, Medium, Low).

🛠️ Execution Instructions for Claude Code

When executing this skill:

1. Information Gathering:

   • Scan package manifests (package.json, requirements.txt, Cargo.toml, go.mod, pom.xml).
   • Inspect build configurations, .gitignore, .env templates, server entry points, and routing files.
   • Run native package vulnerability commands if accessible (e.g., npm audit --json).

2. Codebase Inspection:

   • Run pattern-matching scans for credentials and secrets across the workspace.
   • Trace authentication workflows, route protection middleware, and database queries.
   • Audit response headers and application settings.

3. Report Generation:

   • Group findings by severity (Critical, High, Medium, Low).
   • Provide concrete code references (file_path:line_number).
   • Deliver actionable code patches and remediation commands for every identified vulnerability.

📋 Output Format

Format the audit output using the following markdown structure:

# 🛡️ Security Audit Findings

## Executive Summary
- **Total Issues Found:** X
- **Risk Breakdown:** 🔴 Critical: A | 🟠 High: B | 🟡 Medium: C | 🟢 Low: D

---

## 🔴 Critical & High Vulnerabilities

### 1. [Vulnerability Title]
- **Category:** [e.g., Secrets Exposure / Module 2]
- **File:** `path/to/file.ext:42`
- **Impact:** [Brief description of real-world exploitation risk]
- **Current Code:**
  ```language
  // Problematic snippet