# Security Audit

> Scans the codebase for OWASP Top 10 vulnerabilities (Secrets, Injection, Auth) and manages SECURITY.md.

- Skill: `krishnakanthb13/security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add krishnakanthb13/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/krishnakanthb13/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: krishnakanthb13 (https://skillmd.com/u/krishnakanthb13)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/krishnakanthb13/security-audit

---


# Security Audit (OWASP Standards)

Use this skill to perform a "Paranoid Mode" security sweep.

## Inputs
*   **Scope**: The directory to audit.
*   **Depth**: Full scan or quick check.

## Tooling Strategy
*   Use `grep_search` to find secrets ("API_KEY", "password") and vulnerable patterns (`innerHTML`, `eval`).
*   Use `view_file` to check auth logic.

## Workflow

### 1. Secrets Detection (Credentials)
*   **Scan**: Look for API keys, passwords, tokens, or private keys.
*   **Fix**: Move to `.env`. Add `.env` to `.gitignore`.

### 2. Injection Prevention (OWASP #1)
*   **SQL Injection**: Are queries parameterized? (`$1` vs string concat).
*   **XSS (Cross-Site Scripting)**:
    *   JS: Check `innerHTML` or `dangerouslySetInnerHTML`.
    *   User Input: Is it sanitized/escaped before rendering?

### 3. Authentication & Authorization (Broken Access Control)
*   **Endpoints**: Do sensitive routes (e.g., `/admin`, `/delete`) have middleware checks?
*   **IDOR**: can User A access User B's data by changing an ID in the URL?

### 4. Dependency Analysis (Supply Chain)
*   **Verify**: Check `package.json` or `requirements.txt` for known vulnerable versions.
*   **Unused**: Remove unused packages to reduce attack surface.

### 5. Report Generation (`SECURITY.md`)
Create/Update the report in the root:
*   **Audit Log**: Date of scan.
*   **Findings**:
    *   🔴 **Critical**: Secrets, Injection holes.
    *   🟡 **Warning**: Outdated deps, missing CSRF tokens.
    *   🟢 **Passed**: "Auth implemented on /admin".

### 6. Verification
*   Confirm the fix is applied (e.g., secret is gone from code).
*   Confirm `SECURITY.md` is updated.

## API Security Best Practices
When auditing APIs specifically, verify the following patterns:
- **Authentication**: JWT validation is proper (signature checked, expiry checked).
- **Rate Limiting**: Public endpoints have rate limiting to prevent abuse and DDoS.
- **Data Protection**: 
  - Ensure HTTPS is enforced.
  - Check that error messages are sanitized (no stack traces or DB schema info leaked to the client).
- **Validation**: Schema validation on all request bodies, query params, and headers.