phuc-nt mk-security — Security Audit
Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With --fix, applies fixes iteratively using the mk-autoresearch guard pattern.
When to Use
- Before a release or major deployment
- After adding auth, payment, or data-handling features
- Periodic security review (monthly/quarterly)
- Compliance check (SOC 2, GDPR, PCI-DSS prep)
When NOT to Use
- Purely cosmetic changes (CSS, copy edits)
- No user-facing code or data handling involved
Modes
| Mode | Invocation | Behavior |
|---|---|---|
| Audit only | /mk-security <scope> |
Scan → categorize → report |
| Audit + Fix | /mk-security <scope> --fix |
Scan → categorize → fix iteratively |
| Bounded fix | /mk-security <scope> --fix --iterations N |
Limit fix iterations to N |
Audit Methodology
1. Scope Resolution
Expand the provided glob or full keyword into a file list. Read all in-scope files before analysis.
2. STRIDE Analysis
Evaluate each threat category systematically:
- Spoofing — identity/authentication weaknesses
- Tampering — input validation, integrity controls
- Repudiation — audit logging gaps
- Information Disclosure — data leakage, secret exposure
- Denial of Service — rate limits, resource exhaustion
- Elevation of Privilege — broken access control, RBAC gaps
3. OWASP Top 10 Check
Map findings to OWASP categories (A01–A10). See references/stride-owasp-checklist.md for per-category checks.
4. Dependency Audit
Run the appropriate package audit tool for the detected stack:
- Node.js:
npm audit - Python:
pip-audit - Go:
govulncheck - Ruby:
bundle audit
5. Secret Detection
Scan for hardcoded API keys, passwords, tokens, and private keys using regex patterns. See references/stride-owasp-checklist.md → Secret Patterns.
6. Finding Categorization
Assign each finding a severity level (see Severity Definitions below).
Output Format
## Security Audit Report
### Summary
- Files scanned: N
- Findings: X critical, Y high, Z medium, W low, V info
### Findings
| # | Severity | Category | File:Line | Description | Fix Recommendation |
|---|----------|----------|-----------|-------------|-------------------|
| 1 | Critical | Injection | api/users.ts:45 | SQL string concatenation | Use parameterized queries |
| 2 | High | Auth | auth/login.ts:12 | No rate limiting | Add express-rate-limit |
Fix Mode (--fix)
When --fix is provided, apply fixes iteratively after the audit:
- Sort all findings by severity (Critical → High → Medium → Low)
- For each finding:
a. Apply one targeted fix
b. Run guard (tests or lint) to verify no regression
c. Commit:
security(fix-N): <short description>d. Advance to next finding - Stop early if guard fails — report the failure instead of proceeding
- Uses
mk-autoresearchguard pattern for regression prevention
Tip: Use
--iterations Nto cap total fix iterations when scope is large.
Severity Definitions
| Severity | Description | Fix Priority |
|---|---|---|
| Critical | Exploitable now, data breach or RCE risk | Immediate — block release |
| High | Exploitable with moderate effort, significant impact | This sprint |
| Medium | Limited exploitability or impact | Next sprint |
| Low | Theoretical risk, defense-in-depth improvement | Backlog |
| Info | Best practice suggestion, no direct risk | Optional |
Integration with Other Skills
- Run after
mk-predictwhen the security persona flags concerns - Feed Critical/High findings into
mk-autoresearch --fixfor automated remediation - Use
mk-scenariowith--focus authorizationfor deeper auth flow testing - Pair with
mk-planto schedule Medium/Low findings as sprint tasks
Example Invocations
# Audit API layer only
/mk-security src/api/**/*.ts
# Audit entire src/ and auto-fix, max 15 iterations
/mk-security src/ --fix --iterations 15
# Full codebase audit (no fix)
/mk-security full
See references/stride-owasp-checklist.md for the detailed per-category checklist and secret detection regex patterns.