Code Security Auditor

Code Security Auditor

Overview

This skill enables OpenCode to perform a comprehensive pre-execution security audit of a given codebase and produce a structured, high-signal risk report. It analyzes the entire project including source code, dependency manifests, build scripts, and configuration files from a security-first perspective.

When to Use This Skill

Use this skill when:

• User requests security analysis of a codebase
• User asks to "audit", "scan", or "check" code for safety before running
• User wants to know if code is safe to execute locally
• Analyzing untrusted or third-party code
• Performing due diligence on new dependencies or projects

Analysis Workflow

Step 1: Understand the Project Scope

1. Identify the primary language and ecosystem (JavaScript/Node, Python, Go, Ruby, etc.)
2. Locate all dependency manifests:
   • package.json, package-lock.json (Node.js)
   • requirements.txt, Pipfile, pyproject.toml (Python)
   • Gemfile, Gemfile.lock (Ruby)
   • go.mod, go.sum (Go)
   • Cargo.toml (Rust)
   • pom.xml, build.gradle, build.gradle.kts (Java/Kotlin)
3. Identify entry points: main scripts, entry files, startup commands

Step 2: Perform Static Analysis

1. Dependencies Audit

Scan dependency manifests for:

• Known malicious or compromised packages (check known malware databases)
• Unmaintained packages (no recent updates, abandoned repos)
• Newly published packages (< 30 days) with high download counts
• Typosquatting risks (packages with similar names to popular libraries)
• Packages with install-time scripts (preinstall, postinstall, prepare, prepublish)

Reference: Use references/package_checks.md for known suspicious packages and patterns.

2. Script Inspection

Examine all scripts for:

• Lifecycle hooks in manifest files (postinstall, preinstall, prepare, prepublish)
• Shell execution patterns: exec, spawn, backticks, system(), os.system(), subprocess calls
• Dynamic code execution: eval(), Function(), setTimeout() with strings, pickle.loads(), unserialize()
• Encoded payloads: base64, hex, obfuscated strings, string concatenation
• Download and execute patterns: curl/wget piping to shell

3. File System Behavior

Detect operations that:

• Write outside the project directory
• Access sensitive paths: ~/.ssh, ~/.aws, /etc, /var, /proc, /sys
• Create hidden files: dotfiles in home directory, startup scripts
• Modify system configuration: cron, systemd services, launch agents

4. Network Activity

Identify:

• Hardcoded IP addresses (especially external)
• Hardcoded domains and endpoints
• Suspicious URL patterns: data exfiltration endpoints, command-and-control
• Unexpected ports or protocols
• DNS lookups or reverse IP queries

5. Obfuscation and Evasion

Flag:

• Minified or obfuscated code (especially in dependencies)
• Anti-debugging techniques: debugger detection, stack trace manipulation
• Dynamic imports: import(), require() with variable paths
• Runtime code generation: eval(), new Function(), createElement with strings

Step 3: Risk Assessment

For each finding, assess:

• Impact: What can happen if this code runs locally?
• Likelihood: How likely is this to be malicious vs. legitimate?
• Evidence: Specific file, line number, and code snippet

Potential Impact Categories

• File system compromise: Code that writes to arbitrary locations
• Credential theft: Access to SSH keys, environment variables, tokens, passwords
• Remote command execution: Network-enabled code execution capabilities
• Persistence: Cron jobs, startup scripts, systemd services, launch agents
• Privilege escalation: Code that requests or attempts to gain elevated privileges
• Data exfiltration: Network transmission of sensitive data

Step 4: Generate Structured Report

Produce output following the strict format in Output Format section.

Output Format

🔴 Critical Risks

Provide each critical risk with:

• Risk title: Brief descriptive title
• Evidence: File path, line number, specific code snippet
• Why it is dangerous: Technical explanation of the risk
• What to verify manually: Steps to confirm the finding

🟠 Suspicious Findings

Same structure as critical risks but lower severity.

🟡 Low Risk / Observations

Interesting findings that don't pose immediate danger but worth noting.

🔍 Manual Review Checklist

Provide actionable checklist items:

• Verify specific package legitimacy
• Check maintainer reputation
• Review network connections
• Audit file system operations
• etc.

🚨 Indicators of Malicious Intent

List specific patterns that strongly indicate malicious code:

• Obfuscated code executing commands
• Suspicious network exfiltration
• Persistence mechanism installation
• Credential harvesting patterns

🧾 Final Verdict

Choose ONE and provide justification:

• SAFE TO RUN: No significant risks identified
• SAFE WITH SANDBOX ONLY: Risks exist but contained by sandbox
• HIGH RISK — DO NOT RUN: Significant malicious indicators found

Constraints

• DO NOT assume code is safe
• DO NOT execute any code
• DO NOT skip files
• Prefer false positives over false negatives
• Document all findings, even minor ones

Resources

scripts/

This skill does not require executable scripts.

references/

• package_checks.md: Reference for known suspicious packages, malware patterns, and risky dependency indicators

assets/

This skill does not require assets.