# Code Security

> Scan the current project for security issues, dead code, deprecated patterns, forgotten debug code, secrets in config, and hidden oddities. Use when user says 'scan for issues', 'find security problems', 'codebase audit', 'treasures', 'what's wrong with this codebase', 'find dead code', or 'security scan'. Do NOT use for code review of specific PRs (use review for that). Do NOT use for refactoring suggestions (use code-review for that).

- Skill: `gridlock-nyc/code-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gridlock-nyc/code-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gridlock-nyc/code-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: GRIDLOCK-NYC (https://skillmd.com/u/gridlock-nyc)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gridlock-nyc/code-security

---


# Treasures

Scan the current project for security vulnerabilities, code quality issues, dead code, and hidden oddities. Output a severity-ranked report.

## Important

- Scan the ENTIRE project unless `$ARGUMENTS` specifies a scope (e.g., `auth/`, `src/api/`)
- Never modify any files. This is a read-only audit
- Rank every finding by severity: CRITICAL, HIGH, MEDIUM, LOW, INFO, FUN
- Be specific — include file paths and line numbers for every finding
- Do not report style issues (formatting, naming). Focus on correctness and security
- False positives are worse than missed findings. Only report things you are confident about

## Instructions

### Step 1: Map the project

Read the project structure. Identify:
- Language/framework (package.json, requirements.txt, go.mod, Cargo.toml, etc.)
- Entry points (main files, route definitions, CLI entry)
- Configuration files (.env.example, config/, settings files)
- Test directories

### Step 2: Security scan

Search for these patterns across the codebase:

**CRITICAL / HIGH:**
- Auth bypass flags or backdoors (`bypass`, `skip_auth`, `admin.*true`, `debug.*mode.*prod`)
- Hardcoded secrets, API keys, passwords (`password\s*=`, `secret\s*=`, `api_key\s*=`, `token\s*=` with actual values)
- SQL injection vectors (string concatenation in queries, f-strings in SQL)
- Command injection (`exec(`, `eval(`, `child_process.exec` with user input)
- Unauthenticated endpoints that should require auth
- Deprecated crypto (MD5, SHA1 for authentication/signing, DES)
- Permissive CORS (`Access-Control-Allow-Origin: *` on authenticated endpoints)
- Missing rate limiting on auth endpoints

**MEDIUM:**
- Secrets in example/template files (`.env.example` with real values)
- Hidden feature flags (`DARK_LAUNCH`, `FEATURE_FLAG`, `BETA`)
- Overly permissive file permissions in scripts
- Missing input validation on user-facing endpoints
- Unencrypted sensitive data in logs

**LOW / INFO:**
- Dead routes (defined but no callers)
- Unused exports/functions (exported but never imported elsewhere)
- TODO/HACK/FIXME comments that indicate known issues
- Commented-out code blocks (>10 lines)
- Stale dependencies (check for known-vulnerable versions if lockfile exists)

**FUN:**
- Easter eggs, hidden messages, joke comments
- Unusual file names or directories

### Step 3: Dead code detection

Search for:
- Exported functions/classes never imported by other files
- Route handlers with no corresponding client calls (if both client and server are in repo)
- Config values defined but never read
- Test files for deleted source files

### Step 4: Compile report

Output findings in this format:

```
TREASURES — [project-name] — [N] findings

CRITICAL ([count])
  * [file:line] [description]
    Evidence: [the matching code or pattern]
    Risk: [what could go wrong]

HIGH ([count])
  * [file:line] [description]
    ...

MEDIUM ([count])
  ...

LOW ([count])
  ...

INFO ([count])
  ...

FUN ([count])
  ...

SUMMARY: [1-2 sentence overall assessment]
```

### Step 5: Offer next steps

After the report, offer:
- "Fix critical/high issues now" — walk through fixes one at a time
- "Create GitHub issues for HIGH+" — generate issue descriptions (if gh CLI available)
- "Re-scan [specific area]" — deeper dive into a flagged area

## Error Handling

1. **No source code found**: Report "No scannable source files found in [path]. Is this the right directory?"
2. **Scope argument doesn't exist**: Report "Directory `$ARGUMENTS` not found. Available top-level directories: [list]"
3. **Very large project (>1000 files)**: Scan top-level structure first, then focus on the most likely areas (auth, API, config, database)

## Examples

### Example 1: Full project scan
**Input**: `/code-security`
**Process**: Scans entire project, finds 3 HIGH issues in auth module, 2 MEDIUM in config, 1 FUN easter egg
**Output**: Severity-ranked report with file:line references

### Example 2: Scoped scan
**Input**: `/code-security src/auth/`
**Process**: Deep scan of auth directory only
**Output**: Focused report on auth-related findings

### Example 3: Clean project
**Input**: `/code-security`
**Output**: "TREASURES — acme-api — 0 critical/high findings. 2 LOW items (stale TODOs). Looking solid."