!../principles/SKILL_BODY.md
!../tool-gitnexus/SKILL_BODY.md
Security Audit Workflow
Core Principle
Security vulnerabilities are architectural violations in disguise: injection attacks are layer violations (untrusted data reaching logic without sanitization at the entry boundary); privilege escalation is an SRP violation (authorization logic entangled with business logic); secret leakage is a hidden dependency violation (credentials embedded in code rather than injected from outside). Fixing the architecture fixes the vulnerability.
Limitation declaration: This skill performs static code pattern analysis. It cannot execute npm audit, pip-audit, bandit, semgrep, trivy, or any other automated scanner. The dependency findings in Dimension 4 are a preliminary review — they do not substitute for running real tooling.
Audit Dimensions
Progress tracking: At the start of each dimension, output an updated progress block.
Security Audit Progress
✓ Dimension 1: Input Validation — <Pass / Issues ⚠️ (N gaps)>
→ Dimension 2: Auth & Authorization — in progress
○ Dimension 3: Sensitive Data
○ Dimension 4: Dependencies
Replace ○ with → for the current dimension, and ✓ once complete.
Dimension 1: Input Validation
Scope: All public interfaces, API endpoints, and externally-controlled input paths.
| Check |
Pass condition |
| Entry-layer validation |
All external parameters (request body, query string, headers, file uploads) are validated before entering the logic layer |
| SQL parameterization |
SQL is built with parameterized queries / prepared statements — never string concatenation |
| HTML output escaping |
All user-controlled data is escaped before rendering in HTML (XSS prevention) |
| Shell command safety |
Shell invocations use argument arrays, not string interpolation of user input |
| Path canonicalization |
File paths are resolved (os.path.realpath() / .resolve()) before use to prevent path traversal |
─── Input Validation Findings ───────────────────────
Interface / endpoint: <name>
[ ] Validated at entry layer before logic layer
[ ] SQL parameterized (no string concatenation)
[ ] HTML output escaped
[ ] Shell commands use argument arrays
[ ] File paths canonicalized
Gaps: <list any failing checks>
─────────────────────────────────────────────────────
Dimension 2: Authentication and Authorization
Scope: All access-controlled endpoints, operations, and data reads/writes.
| Check |
Pass condition |
| AuthN at entry layer |
Authentication checks are performed at the entry layer (route handler / controller) — not inside the logic layer |
| AuthZ at entry layer |
Authorization checks are performed at the entry layer alongside authentication |
| Both checked |
Both authentication (who are you?) AND authorization (are you allowed to do this?) are verified — not just one |
| No bypass path |
No path to protected resources exists that skips the auth check (e.g., internal endpoint, direct service call) |
| Tokens out of logs |
Session tokens, JWTs, and auth credentials are excluded from application logs |
| Tenant isolation |
For multi-tenant systems: tenant isolation is enforced at the data query level, not only in the UI |
─── Auth Findings ───────────────────────────────────
Endpoint / operation: <name>
[ ] AuthN check at entry layer
[ ] AuthZ check at entry layer
[ ] Both AuthN and AuthZ verified
[ ] No bypass path identified
[ ] Session / auth tokens excluded from logs
[ ] Tenant isolation enforced (if applicable)
Gaps: <list any failing checks>
─────────────────────────────────────────────────────
Dimension 3: Sensitive Data Handling
Scope: All data storage, transmission, logging, and serialization paths.
| Check |
Pass condition |
| No hardcoded credentials |
No literal credential values assigned to variables matching: password, api_key, secret, token, private_key, access_key (case-insensitive) |
| PII out of logs |
Personally identifiable information (names, emails, phone numbers, national IDs) is not written to logs |
| Sanitized error messages |
Error messages returned to external callers do not expose stack traces, file paths, SQL queries, or internal structure |
| Response field masking |
Sensitive fields (passwords, tokens, PII) are stripped or masked from API response objects before serialization |
| Secrets from environment |
Secrets are loaded from environment variables or a secrets manager — not from committed config files |
─── Sensitive Data Findings ─────────────────────────
[ ] No hardcoded credentials (password/key/secret/token literals)
[ ] PII excluded from logs
[ ] Error messages sanitized for external callers
[ ] Sensitive fields stripped from API responses
[ ] Secrets sourced from env vars / secrets manager (not committed config)
Gaps: <list any failing checks>
─────────────────────────────────────────────────────
Dimension 4: Dependency Review
Scope: Dependency manifest files (package.json, requirements.txt, go.mod, Cargo.toml, pom.xml, pyproject.toml).
Scope boundary: The agent cannot query live CVE databases or confirm current compromise status of packages. This dimension covers checks that can be performed reliably from the manifest file alone. For vulnerability scanning, authoritative tooling is required (see note below).
| Check |
Pass condition |
| Exact version pinning |
All production dependencies use exact versions — no ^, ~, *, or latest ranges; floating ranges in production create non-reproducible builds |
| Lock file committed |
A lock file exists and is committed: package-lock.json, yarn.lock, pnpm-lock.yaml, poetry.lock, Cargo.lock, go.sum |
| Dev/prod separation |
Dev tools, test frameworks, and linters are in devDependencies / [dev-dependencies] — not in production dependencies |
| No self-referential or phantom imports |
No dependencies listed that are not used by the codebase, and no imports used in code that are absent from the manifest |
Authoritative scan required: Run npm audit, pip-audit, cargo audit, or trivy to check for known CVEs and supply-chain issues. The agent cannot reliably identify compromised or vulnerable packages from the manifest text alone.
─── Dependency Review Findings ──────────────────────
[ ] Production dependencies use exact version pinning (no ^ ~ * latest)
[ ] Lock file exists and is committed
[ ] Dev dependencies correctly separated from production dependencies
[ ] No unused or phantom dependencies found
Gaps: <list any failing checks>
⚠️ Authoritative scan required: run npm audit / pip-audit / cargo audit / trivy
─────────────────────────────────────────────────────
Finding Severity Levels
| Level |
Meaning |
Action |
| CRITICAL |
Directly exploitable with no prerequisites (SQL injection, auth bypass, hardcoded admin credential) |
Block merge; fix immediately |
| HIGH |
Exploitable under specific but realistic conditions (missing auth on an endpoint reachable with a valid session) |
Fix before shipping |
| MEDIUM |
Defense-in-depth gap (error message leaks stack trace, no direct exploit path) |
Fix in near-term follow-up |
| LOW |
Best-practice gap with no current exploit path (PII in debug logs, dev dependency in prod bundle) |
Track as tech debt |
Forbidden Actions
- Do not run shell commands, execute scanners, or call external APIs
- Do not mark a finding as "not a vulnerability" because "this code isn't reachable in production" without tracing the actual call path — reachability must be verified, not assumed
- Do not skip Dimension 2 for "internal-only" endpoints — network perimeters can be breached; internal endpoints without auth checks are still vulnerabilities
Reply Format
Security Audit Summary:
| # |
Item |
Detail |
| [1] |
Scope |
<files / endpoints / modules reviewed> |
| [2] |
Findings |
CRITICAL: <count> · HIGH: <count> · MEDIUM: <count> · LOW: <count> |
| [3] |
Dimension status |
Input validation: ✅/⚠️ · Auth/AuthZ: ✅/⚠️ · Sensitive data: ✅/⚠️ · Dependencies: ✅/⚠️ |
| [4] |
Needs your input |
<CRITICAL / HIGH items requiring immediate decision before merge> |
1---2name: security3description: You MUST use this skill before approving or merging any code that touches auth, input handling, permissions, or external data. Use when the review focus is specifically on security vulnerabilities, attack surface, or compliance — not general code quality. Stronger signals: "security review", "check for vulnerabilities", "is this safe", "audit this", "OWASP", "injection", "auth check", "XSS", "SQL injection", "pentest", "threat model". Can run standalone or as a follow-up after sextant:review-code. Use sextant:review-code instead when the goal is general code quality without a security focus.4---56!../principles/SKILL_BODY.md78!../tool-gitnexus/SKILL_BODY.md910---1112# Security Audit Workflow1314## Core Principle1516Security vulnerabilities are architectural violations in disguise: injection attacks are layer violations (untrusted data reaching logic without sanitization at the entry boundary); privilege escalation is an SRP violation (authorization logic entangled with business logic); secret leakage is a hidden dependency violation (credentials embedded in code rather than injected from outside). Fixing the architecture fixes the vulnerability.1718> **Limitation declaration:** This skill performs static code pattern analysis. It cannot execute `npm audit`, `pip-audit`, `bandit`, `semgrep`, `trivy`, or any other automated scanner. The dependency findings in Dimension 4 are a preliminary review — they do not substitute for running real tooling.1920---2122## Audit Dimensions2324> **Progress tracking:** At the start of each dimension, output an updated progress block.25>26> ```27> Security Audit Progress28> ✓ Dimension 1: Input Validation — <Pass / Issues ⚠️ (N gaps)>29> → Dimension 2: Auth & Authorization — in progress30> ○ Dimension 3: Sensitive Data31> ○ Dimension 4: Dependencies32> ```33>34> Replace `○` with `→` for the current dimension, and `✓` once complete.3536### Dimension 1: Input Validation3738**Scope:** All public interfaces, API endpoints, and externally-controlled input paths.3940| Check | Pass condition |41|-------|---------------|42| Entry-layer validation | All external parameters (request body, query string, headers, file uploads) are validated before entering the logic layer |43| SQL parameterization | SQL is built with parameterized queries / prepared statements — never string concatenation |44| HTML output escaping | All user-controlled data is escaped before rendering in HTML (XSS prevention) |45| Shell command safety | Shell invocations use argument arrays, not string interpolation of user input |46| Path canonicalization | File paths are resolved (`os.path.realpath()` / `.resolve()`) before use to prevent path traversal |4748```49─── Input Validation Findings ───────────────────────50Interface / endpoint: <name>51 [ ] Validated at entry layer before logic layer52 [ ] SQL parameterized (no string concatenation)53 [ ] HTML output escaped54 [ ] Shell commands use argument arrays55 [ ] File paths canonicalized56 Gaps: <list any failing checks>57─────────────────────────────────────────────────────58```5960### Dimension 2: Authentication and Authorization6162**Scope:** All access-controlled endpoints, operations, and data reads/writes.6364| Check | Pass condition |65|-------|---------------|66| AuthN at entry layer | Authentication checks are performed at the entry layer (route handler / controller) — not inside the logic layer |67| AuthZ at entry layer | Authorization checks are performed at the entry layer alongside authentication |68| Both checked | Both authentication (who are you?) AND authorization (are you allowed to do this?) are verified — not just one |69| No bypass path | No path to protected resources exists that skips the auth check (e.g., internal endpoint, direct service call) |70| Tokens out of logs | Session tokens, JWTs, and auth credentials are excluded from application logs |71| Tenant isolation | For multi-tenant systems: tenant isolation is enforced at the data query level, not only in the UI |7273```74─── Auth Findings ───────────────────────────────────75Endpoint / operation: <name>76 [ ] AuthN check at entry layer77 [ ] AuthZ check at entry layer78 [ ] Both AuthN and AuthZ verified79 [ ] No bypass path identified80 [ ] Session / auth tokens excluded from logs81 [ ] Tenant isolation enforced (if applicable)82 Gaps: <list any failing checks>83─────────────────────────────────────────────────────84```8586### Dimension 3: Sensitive Data Handling8788**Scope:** All data storage, transmission, logging, and serialization paths.8990| Check | Pass condition |91|-------|---------------|92| No hardcoded credentials | No literal credential values assigned to variables matching: `password`, `api_key`, `secret`, `token`, `private_key`, `access_key` (case-insensitive) |93| PII out of logs | Personally identifiable information (names, emails, phone numbers, national IDs) is not written to logs |94| Sanitized error messages | Error messages returned to external callers do not expose stack traces, file paths, SQL queries, or internal structure |95| Response field masking | Sensitive fields (passwords, tokens, PII) are stripped or masked from API response objects before serialization |96| Secrets from environment | Secrets are loaded from environment variables or a secrets manager — not from committed config files |9798```99─── Sensitive Data Findings ─────────────────────────100 [ ] No hardcoded credentials (password/key/secret/token literals)101 [ ] PII excluded from logs102 [ ] Error messages sanitized for external callers103 [ ] Sensitive fields stripped from API responses104 [ ] Secrets sourced from env vars / secrets manager (not committed config)105 Gaps: <list any failing checks>106─────────────────────────────────────────────────────107```108109### Dimension 4: Dependency Review110111**Scope:** Dependency manifest files (`package.json`, `requirements.txt`, `go.mod`, `Cargo.toml`, `pom.xml`, `pyproject.toml`).112113> **Scope boundary:** The agent cannot query live CVE databases or confirm current compromise status of packages. This dimension covers checks that can be performed reliably from the manifest file alone. For vulnerability scanning, authoritative tooling is required (see note below).114115| Check | Pass condition |116|-------|---------------|117| Exact version pinning | All production dependencies use exact versions — no `^`, `~`, `*`, or `latest` ranges; floating ranges in production create non-reproducible builds |118| Lock file committed | A lock file exists and is committed: `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `poetry.lock`, `Cargo.lock`, `go.sum` |119| Dev/prod separation | Dev tools, test frameworks, and linters are in `devDependencies` / `[dev-dependencies]` — not in production dependencies |120| No self-referential or phantom imports | No dependencies listed that are not used by the codebase, and no imports used in code that are absent from the manifest |121122> **Authoritative scan required:** Run `npm audit`, `pip-audit`, `cargo audit`, or `trivy` to check for known CVEs and supply-chain issues. The agent cannot reliably identify compromised or vulnerable packages from the manifest text alone.123124```125─── Dependency Review Findings ──────────────────────126 [ ] Production dependencies use exact version pinning (no ^ ~ * latest)127 [ ] Lock file exists and is committed128 [ ] Dev dependencies correctly separated from production dependencies129 [ ] No unused or phantom dependencies found130 Gaps: <list any failing checks>131 ⚠️ Authoritative scan required: run npm audit / pip-audit / cargo audit / trivy132─────────────────────────────────────────────────────133```134135---136137## Finding Severity Levels138139| Level | Meaning | Action |140|-------|---------|--------|141| **CRITICAL** | Directly exploitable with no prerequisites (SQL injection, auth bypass, hardcoded admin credential) | Block merge; fix immediately |142| **HIGH** | Exploitable under specific but realistic conditions (missing auth on an endpoint reachable with a valid session) | Fix before shipping |143| **MEDIUM** | Defense-in-depth gap (error message leaks stack trace, no direct exploit path) | Fix in near-term follow-up |144| **LOW** | Best-practice gap with no current exploit path (PII in debug logs, dev dependency in prod bundle) | Track as tech debt |145146---147148## Forbidden Actions149150- Do not run shell commands, execute scanners, or call external APIs151- Do not mark a finding as "not a vulnerability" because "this code isn't reachable in production" without tracing the actual call path — reachability must be verified, not assumed152- Do not skip Dimension 2 for "internal-only" endpoints — network perimeters can be breached; internal endpoints without auth checks are still vulnerabilities153154---155156## Reply Format157158Security Audit Summary:159160| # | Item | Detail |161|---|------|--------|162| [1] | Scope | <files / endpoints / modules reviewed> |163| [2] | Findings | CRITICAL: `<count>` · HIGH: `<count>` · MEDIUM: `<count>` · LOW: `<count>` |164| [3] | Dimension status | Input validation: ✅/⚠️ · Auth/AuthZ: ✅/⚠️ · Sensitive data: ✅/⚠️ · Dependencies: ✅/⚠️ |165| [4] | Needs your input | <CRITICAL / HIGH items requiring immediate decision before merge> |
hellotern