1---2name: code-security-audit3description: Performs OWASP-based code security audits on any codebase. Analyzes source code against ASVS 5.0.0 verification requirements, API Security Top 10 2023 risk patterns, OWASP CheatSheet secure coding practices, and WSTG testing methodologies. Input is a codebase to review; output is a detailed Markdown security audit report. Use when the user requests a security audit, security review, vulnerability assessment, or code security analysis.4---56# Code Security Audit Capabilities78OWASP 4-source integrated code security audit system for universal codebase analysis.910## Knowledge Sources1112- **OWASP ASVS 5.0.0**: 345 verification requirements across 17 security domains (L1/L2/L3)13- **OWASP API Security Top 10 2023**: 10 API-specific risk categories with code-level indicators14- **OWASP CheatSheet Series**: 109 practical secure coding cheat sheets for remediation guidance15- **OWASP WSTG (Web Security Testing Guide)**: 12 testing categories with 120+ test scenarios1617## Source Roles1819| Source | Role | Usage |20|--------|------|-------|21| ASVS 5.0.0 | Verification requirements baseline | Defines what to check — structured requirements per domain |22| API Security Top 10 2023 | Risk taxonomy | Defines what to look for — API-specific threat patterns |23| CheatSheet Series | Implementation guidance | Defines how to fix — secure coding patterns and practices |24| WSTG | Test methodology | Defines how to verify — concrete test scenarios per vulnerability |2526## Domains2728- **Input Handling** (V1, V2, V5): Encoding, sanitization, injection prevention, validation, file handling29- **Authentication & Session** (V6, V7, V9, V10): Auth mechanisms, session management, token handling, OAuth/OIDC30- **Authorization** (V8): Object-level, function-level, property-level access control31- **Cryptography** (V11, V12): Storage encryption, key management, TLS configuration32- **API Security** (V4, V17): REST/GraphQL/WebSocket/WebRTC security, rate limiting, resource consumption33- **Data Protection** (V14): Sensitive data exposure, privacy controls, client-side data34- **Configuration** (V13, V16): Security headers, CORS, error handling, logging, deployment hardening35- **Secure Coding** (V3, V15): Web frontend security, architecture patterns, defensive coding, concurrency safety3637## Input Contract3839| Field | Required | Description |40|-------|----------|-------------|41| **Codebase path** | Yes | The current workspace or repository the agent is operating in. Defaults to the active codebase; users may narrow scope to specific directories or files (e.g., `src/auth/`, `api/controllers/`) |42| **Audit level** | No | ASVS verification level (default: **L2**). See level definitions below |43| **Focus areas** | No | Security domains to prioritize. See focus area catalog below |44| **Tech context** | No | Language, framework, or architecture notes for targeted analysis |4546### Audit Levels (OWASP ASVS 5.0.0)4748| Level | Target Application | Requirements | Description |49|-------|-------------------|-------------|-------------|50| **L1** | All applications | ~86 | Essential baseline — covers critical vulnerabilities that are typically exploitable and must be addressed in every application (e.g., SQL injection, OS command injection, basic auth checks) |51| **L2** | Applications handling sensitive data (PII, financial, health) | ~230 | Standard security — includes L1 plus defense-in-depth controls such as SSRF protection, template injection prevention, secure session management, and proper cryptographic usage |52| **L3** | Mission-critical systems (banking, healthcare, military, infrastructure) | ~345 | Comprehensive defense — includes L1+L2 plus advanced controls such as formula injection prevention, full input canonicalization, and exhaustive cryptographic verification |5354### Focus Area Catalog5556| Focus Area | Domains | Example Checks |57|------------|---------|----------------|58| **authentication** | V6, V7, V9, V10 | Password storage, MFA, OAuth/OIDC flow, credential rotation |59| **authorization** | V8 | Object-level (BOLA), function-level, property-level access control |60| **injection** | V1, V2 | SQLi, XSS, command injection, LDAP/XPath injection, template injection, XXE |61| **cryptography** | V11, V12 | Weak algorithms, key management, TLS configuration, secret storage |62| **api-security** | V4, V17 | Rate limiting, resource consumption, REST/GraphQL/WebSocket security |63| **session** | V7, V9, V10 | Token handling, session fixation, cookie attributes, JWT validation, CSRF |64| **file-handling** | V5 | Path traversal, unrestricted upload, file type validation, storage security |65| **data-protection** | V14 | Sensitive data exposure, privacy controls, client-side data leakage |66| **configuration** | V13, V16 | Security headers, CORS, error handling, logging, deployment hardening |67| **secure-coding** | V3, V15 | Frontend security, concurrency safety, architecture patterns, defensive coding |6869## Preconditions7071- Codebase is accessible and readable72- Agent has file search and read capabilities73- If codebase structure cannot be determined, the agent reports limitations in the audit output7475## Core Capabilities7677- **Codebase Reconnaissance**: Identifies technology stack, frameworks, entry points, and security-relevant file areas78- **Domain-Scoped Analysis**: Systematically audits code across all 8 security domains79- **ASVS Requirement Verification**: Checks code against applicable ASVS 5.0.0 requirements at the specified level80- **Vulnerability Pattern Detection**: Identifies known vulnerable code patterns from the integrated knowledge base81- **Cross-Source Correlation**: Maps findings to ASVS requirements, API Top 10 risks, CheatSheet guidance, and WSTG test IDs82- **Severity Classification**: Rates findings as Critical/High/Medium/Low with evidence and confidence83- **Remediation Guidance**: Provides concrete fix patterns sourced from CheatSheet Series84- **Structured Report Generation**: Produces a comprehensive Markdown audit report8586## Audit Workflow8788```891. Reconnaissance → Identify stack, structure, entry points902. Scope Definition → Select applicable ASVS domains and level913. Domain Analysis → Audit each security domain systematically924. Finding Synthesis → Deduplicate, correlate across sources, assign severity935. Remediation Map → Attach fix patterns per finding946. Report Generation → Produce structured Markdown report95```9697## Output Contract9899The audit produces a Markdown report containing:100101- **Executive Summary**: Overall risk posture, critical findings count, audit scope102- **Findings Table**: Each finding with severity, ASVS ID, CWE, evidence, and remediation103- **Domain Reports**: Per-domain detailed analysis with code references104- **Remediation Roadmap**: Prioritized fix recommendations105- **Audit Metadata**: Scope, level, limitations, methodology notes106107## Severity Levels108109| Level | Criteria |110|-------|----------|111| **Critical** | Exploitable vulnerability with direct security impact (RCE, SQLi, auth bypass, data breach) |112| **High** | Significant security weakness requiring prompt remediation (broken access control, weak crypto, SSRF) |113| **Medium** | Security concern with conditional exploitability (missing headers, verbose errors, weak validation) |114| **Low** | Defense-in-depth improvement or best practice deviation (logging gaps, minor config issues) |115| **Info** | Observation or recommendation with no direct security impact |116117## Technical References118119- **[audit_process.md](references/audit_process.md)**: Complete step-by-step audit methodology and reconnaissance procedures120- **[security_domains.md](references/security_domains.md)**: All 17 ASVS domains with code-audit-relevant requirements and cross-source mappings121- **[vulnerability_patterns.md](references/vulnerability_patterns.md)**: Concrete code-level vulnerability patterns organized by category122- **[remediation_patterns.md](references/remediation_patterns.md)**: Secure coding fix patterns from CheatSheet Series123- **[report_format.md](references/report_format.md)**: Detailed Markdown report structure and finding schema
buyoung