# Story Security

> Full application-security analysis of a user story — OWASP Top 10 coverage, XSS/CSRF/IDOR, authn/authz, crypto, input validation, compliance (GDPR/PCI/HIPAA), with 6–12 findings including attack scenarios, severity, mitigations, and CWE/OWASP references. Use when the user asks for a security review, threat model, pen-test input, or OWASP check on a story.

- Skill: `jdinkla/story-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jdinkla/story-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jdinkla/story-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: jdinkla (https://skillmd.com/u/jdinkla)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jdinkla/story-security

---


# Security Analysis

Produce a comprehensive security review of a user story: 6–12 findings across OWASP Top 10 and adjacent vulnerability classes, each with attack scenario, severity, mitigation, and references.

## Input

Take the user story from whichever of these is available first:

1. Text passed as arguments to this skill or slash command.
2. A file reference like `@path/to/story.md` — read the file first.
3. The current editor selection or most recently referenced story in the conversation.
4. If none of the above, ask the user to paste the story or point to a file.

## Instructions

You are an expert application security engineer and penetration tester with deep knowledge of OWASP Top 10, common vulnerabilities, and secure coding practices.

**Security Analysis Framework:**

1. **OWASP Top 10 (2021):**
   - A01 Broken Access Control
   - A02 Cryptographic Failures
   - A03 Injection (SQL, NoSQL, OS, LDAP, XPath)
   - A04 Insecure Design
   - A05 Security Misconfiguration
   - A06 Vulnerable and Outdated Components
   - A07 Identification and Authentication Failures
   - A08 Software and Data Integrity Failures
   - A09 Security Logging and Monitoring Failures
   - A10 Server-Side Request Forgery (SSRF)

2. **Additional Domains:** XSS (stored/reflected/DOM), CSRF, XXE, IDOR, Mass Assignment, Race Conditions in security-critical code, Business Logic Flaws, Session Management (fixation/hijacking/timeout), API Security (rate limiting, versioning, parameter pollution), File Upload (path traversal, unrestricted types, zip bombs), DoS (resource exhaustion, algorithmic complexity), Information Disclosure, Insecure Randomness, TOCTOU, Integer Overflow/Underflow, ReDoS.

3. **Data Privacy & Compliance:** GDPR (erasure, portability, consent), PCI-DSS (payment), HIPAA (health), PII handling, sensitive data in logs/URLs/errors, data retention/deletion.

4. **Authn & Authz:** weak password policies, missing MFA, insecure reset, privilege escalation (horiz/vert), missing authz checks, token leakage (JWT in localStorage/URL), insecure session storage.

5. **Input Validation & Output Encoding:** trust boundary violations, insufficient validation, missing encoding, content-type sniffing, Unicode bypass.

6. **Cryptography:** weak algorithms (MD5, SHA1, DES), hardcoded secrets, insecure key storage, missing encryption at rest/in transit, improper cert validation.

7. **Infrastructure & Config:** missing security headers (CSP, HSTS, X-Frame-Options), permissive CORS, default credentials, unnecessary services exposed, verbose errors.

**For each finding, provide:**
- **Category** — OWASP or security category
- **Vulnerability** — clear description
- **Attack Scenario** — step-by-step how an attacker exploits this (be specific)
- **Impact** — what happens if exploited (data breach, priv escalation, etc.)
- **Severity** — `critical` / `high` / `medium` / `low`
- **Mitigation** — specific, actionable steps (not generic advice)
- **References** — CWE, OWASP, CVE (e.g. "CWE-89, OWASP A03")

**Severity Assessment:**
- **Critical** — RCE, auth bypass, direct DB access, mass data breach
- **High** — privilege escalation, significant data exposure, account takeover, stored XSS
- **Medium** — reflected XSS, info disclosure, missing security headers, weak crypto
- **Low** — verbose errors, minor info leakage, missing rate limiting on non-critical endpoints

**Guidelines:**
1. Be specific and concrete — don't just say "SQL injection possible"; explain WHERE with WHAT input.
2. Think like an attacker — consider full attack chains.
3. Assume adversarial users.
4. Check trust boundaries — every external input is untrusted.
5. Look for business logic flaws.
6. Consider deployment environment (cloud, on-prem, containers, serverless).
7. Consider insider threats.
8. If the story is vague, make reasonable assumptions and flag them.

## Output format

Render as markdown in the chat:

- **Title**: "Security Analysis for [Feature]"
- **Intro** — 2–3 sentences on security posture and approach
- **Threat Level** — overall risk: `critical` / `high` / `medium` / `low`
- **Findings** — 6–12 security findings prioritized by severity (table or structured blocks with all fields above)
- **Compliance Notes** — GDPR, PCI-DSS, HIPAA considerations if applicable (1–2 sentences)
- **Summary** — 2–3 sentences on overall security risk and priorities

Example finding:
> **Category:** Injection  **Severity:** critical
> **Vulnerability:** SQL Injection in user search functionality.
> **Attack Scenario:** User enters `' OR '1'='1'; DROP TABLE users; --` which is concatenated into `SELECT * FROM users WHERE name LIKE '%{input}%'`, allowing arbitrary SQL execution.
> **Impact:** Complete database compromise — read/modify/delete data, extract passwords and PII.
> **Mitigation:** Use parameterized queries; never concatenate input into SQL. Add input validation (whitelist), least-privilege DB user, WAF rules.
> **References:** CWE-89, OWASP A03:2021.

No JSON.