/security-scan — 6-Layer Security Pipeline
What
Runs a defense-in-depth static scan across 6 layers. A project with zero CVEs
can still have hardcoded secrets, SQL injection, and missing auth — each layer
catches a different vulnerability class. Findings map to the OWASP Top
10:2025 taxonomy and are rated Critical/High/Medium/Low by exploitability,
impact, and exposure — a Critical SQL injection on a public endpoint outranks a
Low info-disclosure on an admin page.
Detection patterns, OWASP mappings, remediation code, and the report template
live in references/scan-layers.md — read it before executing.
Honesty rule: this is static analysis, not a penetration test. It catches
known patterns but misses business-logic flaws, complex authorization bypasses,
and runtime-only vulnerabilities. Every report states this.
When
- Pre-release security gate — full scan, non-negotiable before production
- "Security scan", "security audit", "find secrets", "CVE check", "OWASP"
- After a dependency update (Layer 1), auth changes (Layer 4), config changes
(Layer 2), or logging changes (Layer 6)
- Pre-pentest preparation — fix static issues before paying for a pentest
- Incident response and quarterly reviews
How
Step 1: Choose Layers
| Scenario |
Layers |
| Pre-release gate / pentest prep / incident / quarterly |
All 6 |
| After dependency update |
1 |
| New endpoint added |
3, 4, 5 |
| Auth system changes |
4 |
| Config file changes |
2 |
| Logging changes |
6 |
| Public API exposure |
3, 4, 5 |
| Internal-only service |
1, 2, 3 |
Step 2: Execute the Layers
Read references/scan-layers.md for the detection patterns per layer.
Delegate deep auth and secrets review to the security-auditor agent, pairing
the authentication and configuration skills.
| # |
Layer |
OWASP 2025 |
Method |
| 1 |
Package vulnerabilities |
A03 Supply Chain |
dotnet list package --vulnerable --include-transitive |
| 2 |
Secrets detection |
— |
Pattern scan over .cs/.json/.yml/.xml/.config |
| 3 |
OWASP code patterns |
A05 Injection, A08 Integrity, A04 Crypto, A01 Access Control |
Source scan: raw SQL, Html.Raw, BinaryFormatter, MD5/SHA1, IDOR |
| 4 |
Auth configuration |
A07 Authentication, A01 Access Control |
get_endpoint_map — every route's auth posture in one call; flag unmarked endpoints; then JWT validation settings |
| 5 |
CORS policy |
A02 Misconfiguration |
Wildcard origins, credentials combos, method/header breadth |
| 6 |
Data protection |
A04 Crypto, A09 Logging & Alerting |
PII in logs, over-broad responses, plaintext sensitive storage |
Step 3: Rate with Context
Severity must match actual risk — over-classification causes alert fatigue and
buries the real Critical:
- Test-fixture "secrets" and appsettings.Development.json values are expected —
skip or mark INFO, don't flag as HIGH
- A missing XML comment is never a security finding
- Reserve Critical for exploitable-now issues: injection on public endpoints,
exposed production secrets, auth bypass
Step 4: Report
Every finding: [SEVERITY] file:line — title, OWASP category, what's wrong,
impact if exploited, and remediation code (before/after). Produce the summary
table + per-layer status table from the reference template, prefixed with the
static-analysis disclaimer.
Example
User: /security-scan before we ship
Claude: Running all 6 layers...
| Layer | Status | Findings |
|-------|--------|----------|
| 1. Packages | PASS | 0 CVEs (142 packages incl. transitive) |
| 2. Secrets | PASS | 0 real secrets (2 dev-only values skipped) |
| 3. OWASP Patterns | FAIL | 1 SQL injection |
| 4. Auth Config | WARN | 2 endpoints missing explicit auth attributes |
| 5. CORS | PASS | Explicit origins from configuration |
| 6. Data Protection | WARN | Customer email logged at Information level |
[HIGH] SearchOrders.cs:34 — SQL Injection (A05:2025)
FromSqlRaw($"...LIKE '%{search}%'") → attacker controls the query.
Fix: db.Orders.Where(o => EF.Functions.Like(o.Name, $"%{search}%"))
[MEDIUM] OrderEndpoints.cs:18,31 — no [Authorize]/[AllowAnonymous]; behavior
depends on ambient global policy. Make intent explicit per endpoint.
[LOW] OrderPlacedHandler.cs:22 — PII in logs (A09:2025). Log CustomerId, not email.
Note: static analysis only — this does not replace a penetration test.
Related
references/scan-layers.md — detection patterns, OWASP 2025 mappings, report template/verify — Phase 5 runs a lightweight version of this scan per change set/health-check — Dimension 7 (Security Posture) is the spot-check versionauthentication / configuration — remediation patterns for Layers 4 and 2
1---
2name: security-scan
3description: >
4 Deep security scanning for .NET applications across 6 layers: vulnerable packages,
5 secrets detection, OWASP code patterns, auth configuration, CORS policy, and
6 data protection. Produces severity-rated findings with specific remediation steps.
7 Load this skill when: "security scan", "security audit", "check for vulnerabilities",
8 "find secrets", "OWASP", "auth review", "CORS check", "security review",
9 "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password",
10 "data protection", "security posture".
11---
12
13# /security-scan — 6-Layer Security Pipeline
14
15## What
16
17Runs a defense-in-depth static scan across 6 layers. A project with zero CVEs
18can still have hardcoded secrets, SQL injection, and missing auth — each layer
19catches a different vulnerability class. Findings map to the **OWASP Top
2010:2025** taxonomy and are rated Critical/High/Medium/Low by exploitability,
21impact, and exposure — a Critical SQL injection on a public endpoint outranks a
22Low info-disclosure on an admin page.
23
24Detection patterns, OWASP mappings, remediation code, and the report template
25live in `references/scan-layers.md` — read it before executing.
26
27**Honesty rule:** this is static analysis, not a penetration test. It catches
28known patterns but misses business-logic flaws, complex authorization bypasses,
29and runtime-only vulnerabilities. Every report states this.
30
31## When
32
33- Pre-release security gate — full scan, non-negotiable before production
34- "Security scan", "security audit", "find secrets", "CVE check", "OWASP"
35- After a dependency update (Layer 1), auth changes (Layer 4), config changes
36 (Layer 2), or logging changes (Layer 6)
37- Pre-pentest preparation — fix static issues before paying for a pentest
38- Incident response and quarterly reviews
39
40## How
41
42### Step 1: Choose Layers
43
44| Scenario | Layers |
45|----------|--------|
46| Pre-release gate / pentest prep / incident / quarterly | All 6 |
47| After dependency update | 1 |
48| New endpoint added | 3, 4, 5 |
49| Auth system changes | 4 |
50| Config file changes | 2 |
51| Logging changes | 6 |
52| Public API exposure | 3, 4, 5 |
53| Internal-only service | 1, 2, 3 |
54
55### Step 2: Execute the Layers
56
57Read `references/scan-layers.md` for the detection patterns per layer.
58Delegate deep auth and secrets review to the `security-auditor` agent, pairing
59the `authentication` and `configuration` skills.
60
61| # | Layer | OWASP 2025 | Method |
62|---|-------|-----------|--------|
63| 1 | Package vulnerabilities | A03 Supply Chain | `dotnet list package --vulnerable --include-transitive` |
64| 2 | Secrets detection | — | Pattern scan over .cs/.json/.yml/.xml/.config |
65| 3 | OWASP code patterns | A05 Injection, A08 Integrity, A04 Crypto, A01 Access Control | Source scan: raw SQL, `Html.Raw`, `BinaryFormatter`, MD5/SHA1, IDOR |
66| 4 | Auth configuration | A07 Authentication, A01 Access Control | `get_endpoint_map` — every route's auth posture in one call; flag `unmarked` endpoints; then JWT validation settings |
67| 5 | CORS policy | A02 Misconfiguration | Wildcard origins, credentials combos, method/header breadth |
68| 6 | Data protection | A04 Crypto, A09 Logging & Alerting | PII in logs, over-broad responses, plaintext sensitive storage |
69
70### Step 3: Rate with Context
71
72Severity must match actual risk — over-classification causes alert fatigue and
73buries the real Critical:
74
75- Test-fixture "secrets" and appsettings.Development.json values are expected —
76 skip or mark INFO, don't flag as HIGH
77- A missing XML comment is never a security finding
78- Reserve Critical for exploitable-now issues: injection on public endpoints,
79 exposed production secrets, auth bypass
80
81### Step 4: Report
82
83Every finding: `[SEVERITY] file:line — title`, OWASP category, what's wrong,
84impact if exploited, and remediation code (before/after). Produce the summary
85table + per-layer status table from the reference template, prefixed with the
86static-analysis disclaimer.
87
88## Example
89
90```
91User: /security-scan before we ship
92
93Claude: Running all 6 layers...
94
95| Layer | Status | Findings |
96|-------|--------|----------|
97| 1. Packages | PASS | 0 CVEs (142 packages incl. transitive) |
98| 2. Secrets | PASS | 0 real secrets (2 dev-only values skipped) |
99| 3. OWASP Patterns | FAIL | 1 SQL injection |
100| 4. Auth Config | WARN | 2 endpoints missing explicit auth attributes |
101| 5. CORS | PASS | Explicit origins from configuration |
102| 6. Data Protection | WARN | Customer email logged at Information level |
103
104[HIGH] SearchOrders.cs:34 — SQL Injection (A05:2025)
105 FromSqlRaw($"...LIKE '%{search}%'") → attacker controls the query.
106 Fix: db.Orders.Where(o => EF.Functions.Like(o.Name, $"%{search}%"))
107
108[MEDIUM] OrderEndpoints.cs:18,31 — no [Authorize]/[AllowAnonymous]; behavior
109 depends on ambient global policy. Make intent explicit per endpoint.
110
111[LOW] OrderPlacedHandler.cs:22 — PII in logs (A09:2025). Log CustomerId, not email.
112
113Note: static analysis only — this does not replace a penetration test.
114```
115
116## Related
117
118- `references/scan-layers.md` — detection patterns, OWASP 2025 mappings, report template
119- `/verify` — Phase 5 runs a lightweight version of this scan per change set
120- `/health-check` — Dimension 7 (Security Posture) is the spot-check version
121- `authentication` / `configuration` — remediation patterns for Layers 4 and 2
codewithmukesh