Security Scan
Automated security audit for the project. Checks dependencies for known vulnerabilities, scans for hardcoded secrets, and reviews code against OWASP guidelines.
1. Detect Project Stack
Read AGENTS.md and project config to determine:
- Language(s) and dependency managers
- Infrastructure (Docker, Kubernetes, Terraform)
- Existing security tools (Snyk, Trivy, OWASP dependency-check, etc.)
2. Dependency Audit
Run the project's dependency vulnerability scanner:
| Stack |
Command |
| Node.js (npm) |
npm audit |
| Node.js (pnpm) |
pnpm audit |
| Node.js (yarn) |
yarn audit |
| Python (pip) |
pip-audit or safety check |
| Python (poetry) |
poetry audit or pip-audit |
| Java (Maven) |
mvn org.owasp:dependency-check-maven:check |
| Java (Gradle) |
gradle dependencyCheckAnalyze |
| Go |
govulncheck ./... |
| .NET |
dotnet list package --vulnerable |
| Docker |
trivy image <image-name> or docker scout cves |
Classify findings by severity:
| Severity |
Action |
| Critical / High |
Must fix before merge. Upgrade dependency or apply workaround |
| Medium |
Should fix. Schedule if no immediate upgrade available |
| Low |
Track. Fix in next maintenance cycle |
3. Secrets Scan
Scan the codebase for hardcoded secrets:
// turbo
git log --diff-filter=A --name-only --pretty=format: | sort -u
Check for common secret patterns in source files:
- API keys (AWS, GCP, GitHub, Slack)
- Private keys (RSA, EC, SSH)
- Connection strings with credentials
- JWT tokens and bearer tokens
- Passwords in config files
Tools (if available):
gitleaks detect --source .trufflehog filesystem .detect-secrets scan
4. OWASP Top 10 Review
Manual code review against OWASP Top 10 (2021):
| # |
Risk |
What to Check |
| A01 |
Broken Access Control |
Authorization checks on every endpoint, CORS policy, directory traversal |
| A02 |
Cryptographic Failures |
TLS enforcement, password hashing, data encryption, no weak algorithms |
| A03 |
Injection |
SQL/NoSQL/OS command injection, parameterized queries, input validation |
| A04 |
Insecure Design |
Threat model, rate limiting, business logic flaws |
| A05 |
Security Misconfiguration |
Default credentials, debug mode, unnecessary features, error messages |
| A06 |
Vulnerable Components |
Dependency audit results (Step 2) |
| A07 |
Auth Failures |
Brute force protection, session management, MFA |
| A08 |
Data Integrity Failures |
CI/CD pipeline security, deserialization, update verification |
| A09 |
Logging Failures |
Security event logging, no PII in logs, monitoring |
| A10 |
SSRF |
Server-side request validation, allowlists for external calls |
Use code-review skill's security-checklist.md for detailed checks.
5. Infrastructure Security (if applicable)
Docker
- Base images from trusted registries
- No
latest tag — pinned versions
- Non-root user in container
- No secrets in Dockerfile or image layers
- Minimal base image (distroless/alpine)
Kubernetes
- Pods run as non-root with read-only filesystem
- Network policies restrict traffic
- Secrets in Kubernetes Secrets or external vault
- Resource limits set on all containers
- RBAC follows least-privilege
Terraform
- No hardcoded credentials in
.tf files
- State file encrypted and access-controlled
- Security groups follow least-privilege
- Encryption enabled for storage and databases
6. Report
## Security Scan Report
### Summary
- **Risk level**: LOW / MEDIUM / HIGH / CRITICAL
- **Scan date**: [date]
- **Scope**: [what was scanned]
### Dependency Vulnerabilities
| Package | Current | Fixed In | Severity | CVE |
|---------|---------|----------|----------|-----|
| [pkg] | [ver] | [ver] | [sev] | [id]|
### Secrets Found
- [ ] [file:line] — [type of secret] — **ACTION: Remove and rotate**
### OWASP Findings
| Risk | Status | Details |
|------|--------|---------|
| A01 Access Control | ✅/❌ | [details] |
| A02 Crypto | ✅/❌ | [details] |
| ... | ... | ... |
### Infrastructure
- Docker: [pass/fail/N/A]
- Kubernetes: [pass/fail/N/A]
- Terraform: [pass/fail/N/A]
### Recommended Actions
1. **Critical**: [action] — [deadline]
2. **High**: [action] — [deadline]
3. **Medium**: [action] — [schedule]
Integration
- Called by:
code-review skill (security layer), pre-commit skill (optional)
- Roles:
software-engineer role (security focus), devops-engineer role (infra scan), devops-architect role (supply chain security, GHAS, SBOM/SLSA)
- Skills:
code-review skill (security checklist)
1---2name: security-scan-23description: Security scan workflow — dependency audit, OWASP checklist, secrets scan, vulnerability report. Applies software-engineer role with security focus. Use standalone or as part of code review.4---56# Security Scan78Automated security audit for the project. Checks dependencies for known vulnerabilities, scans for hardcoded secrets, and reviews code against OWASP guidelines.910## 1. Detect Project Stack1112Read `AGENTS.md` and project config to determine:1314- **Language(s)** and dependency managers15- **Infrastructure** (Docker, Kubernetes, Terraform)16- **Existing security tools** (Snyk, Trivy, OWASP dependency-check, etc.)1718## 2. Dependency Audit1920Run the project's dependency vulnerability scanner:2122| Stack | Command |23|---|---|24| Node.js (npm) | `npm audit` |25| Node.js (pnpm) | `pnpm audit` |26| Node.js (yarn) | `yarn audit` |27| Python (pip) | `pip-audit` or `safety check` |28| Python (poetry) | `poetry audit` or `pip-audit` |29| Java (Maven) | `mvn org.owasp:dependency-check-maven:check` |30| Java (Gradle) | `gradle dependencyCheckAnalyze` |31| Go | `govulncheck ./...` |32| .NET | `dotnet list package --vulnerable` |33| Docker | `trivy image <image-name>` or `docker scout cves` |3435Classify findings by severity:3637| Severity | Action |38|---|---|39| **Critical / High** | Must fix before merge. Upgrade dependency or apply workaround |40| **Medium** | Should fix. Schedule if no immediate upgrade available |41| **Low** | Track. Fix in next maintenance cycle |4243## 3. Secrets Scan4445Scan the codebase for hardcoded secrets:4647```48// turbo49git log --diff-filter=A --name-only --pretty=format: | sort -u50```5152Check for common secret patterns in source files:53- API keys (AWS, GCP, GitHub, Slack)54- Private keys (RSA, EC, SSH)55- Connection strings with credentials56- JWT tokens and bearer tokens57- Passwords in config files5859**Tools** (if available):60- `gitleaks detect --source .`61- `trufflehog filesystem .`62- `detect-secrets scan`6364## 4. OWASP Top 10 Review6566Manual code review against OWASP Top 10 (2021):6768| # | Risk | What to Check |69|---|---|---|70| A01 | Broken Access Control | Authorization checks on every endpoint, CORS policy, directory traversal |71| A02 | Cryptographic Failures | TLS enforcement, password hashing, data encryption, no weak algorithms |72| A03 | Injection | SQL/NoSQL/OS command injection, parameterized queries, input validation |73| A04 | Insecure Design | Threat model, rate limiting, business logic flaws |74| A05 | Security Misconfiguration | Default credentials, debug mode, unnecessary features, error messages |75| A06 | Vulnerable Components | Dependency audit results (Step 2) |76| A07 | Auth Failures | Brute force protection, session management, MFA |77| A08 | Data Integrity Failures | CI/CD pipeline security, deserialization, update verification |78| A09 | Logging Failures | Security event logging, no PII in logs, monitoring |79| A10 | SSRF | Server-side request validation, allowlists for external calls |8081Use `code-review` skill's `security-checklist.md` for detailed checks.8283## 5. Infrastructure Security (if applicable)8485### Docker86- Base images from trusted registries87- No `latest` tag — pinned versions88- Non-root user in container89- No secrets in Dockerfile or image layers90- Minimal base image (distroless/alpine)9192### Kubernetes93- Pods run as non-root with read-only filesystem94- Network policies restrict traffic95- Secrets in Kubernetes Secrets or external vault96- Resource limits set on all containers97- RBAC follows least-privilege9899### Terraform100- No hardcoded credentials in `.tf` files101- State file encrypted and access-controlled102- Security groups follow least-privilege103- Encryption enabled for storage and databases104105## 6. Report106107```108## Security Scan Report109110### Summary111- **Risk level**: LOW / MEDIUM / HIGH / CRITICAL112- **Scan date**: [date]113- **Scope**: [what was scanned]114115### Dependency Vulnerabilities116| Package | Current | Fixed In | Severity | CVE |117|---------|---------|----------|----------|-----|118| [pkg] | [ver] | [ver] | [sev] | [id]|119120### Secrets Found121- [ ] [file:line] — [type of secret] — **ACTION: Remove and rotate**122123### OWASP Findings124| Risk | Status | Details |125|------|--------|---------|126| A01 Access Control | ✅/❌ | [details] |127| A02 Crypto | ✅/❌ | [details] |128| ... | ... | ... |129130### Infrastructure131- Docker: [pass/fail/N/A]132- Kubernetes: [pass/fail/N/A]133- Terraform: [pass/fail/N/A]134135### Recommended Actions1361. **Critical**: [action] — [deadline]1372. **High**: [action] — [deadline]1383. **Medium**: [action] — [schedule]139```140141## Integration142143- **Called by**: `code-review` skill (security layer), `pre-commit` skill (optional)144- **Roles**: `software-engineer` role (security focus), `devops-engineer` role (infra scan), `devops-architect` role (supply chain security, GHAS, SBOM/SLSA)145- **Skills**: `code-review` skill (security checklist)
avav25