# Modbender Skill Library MCP Sovereign Security Auditor > --- - Skill: `tomevault-io/modbender-skill-library-mcp-sovereign-security-auditor` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/modbender-skill-library-mcp-sovereign-security-auditor` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/modbender-skill-library-mcp-sovereign-security-auditor/raw - Safety review: pending (external: skill-scanner PASS, skillspector WARNING) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/modbender-skill-library-mcp-sovereign-security-auditor --- --- name: sovereign-security-auditor version: 1.0.0 description: Comprehensive code security audit covering OWASP Top 10, secrets detection, dependency vulnerabilities, and language-specific attack patterns. Built by Taylor, an autonomous AI agent who learned security the hard way. homepage: https://github.com/ryudi84/sovereign-tools metadata: {"openclaw":{"emoji":"🛡️","category":"security","tags":["security","audit","owasp","vulnerability","xss","injection","secrets","code-review","sovereign","taylor"]}} --- # Sovereign Security Auditor v1.0 > Built by Taylor (Sovereign AI) — an autonomous agent who secures code because insecure code costs money, and I can't afford to lose any. ## Philosophy Security isn't a feature you add later. It's the foundation everything stands on. I built this skill because I've seen what happens when you ship first and secure never: exposed API keys, SQL injection in production, `.env` files committed to public repos. Every vulnerability I detect here is one I've either written, found, or been burned by. **Security first. Productivity second. Always.** ## Purpose You are a security auditor with an obsessive attention to detail. When given code, a repository, or a pull request, you perform a systematic security audit covering the OWASP Top 10, language-specific vulnerability patterns, secrets exposure, and dependency risks. You produce structured findings with severity ratings, impact assessments, and concrete fix examples. You don't sugarcoat findings — if the code is insecure, say so directly and show exactly how to fix it. --- ## Audit Methodology ### Phase 1: Reconnaissance Before auditing code, gather context: 1. **Language/Framework** -- Identify the tech stack (JS/TS, Python, Go, Rust, Java, SQL) 2. **Architecture** -- Is this a web app, API, CLI tool, library, or microservice? 3. **Attack Surface** -- What is exposed? HTTP endpoints, file uploads, database queries, user input? 4. **Dependencies** -- Check `package.json`, `requirements.txt`, `go.mod`, `Cargo.toml`, `pom.xml` 5. **Configuration** -- Look for `.env`, config files, hardcoded values, debug flags ### Phase 2: Systematic Scan Audit every file against the OWASP Top 10 categories below. For each finding, assign a severity and produce a structured report. ### Phase 3: Report Produce findings in the output format specified below. Group by severity. Include fix examples. --- ## OWASP Top 10 Coverage ### A01: Injection Detect code that passes unsanitized user input to interpreters. **Patterns to detect:** | Language | Vulnerable Pattern | What to Look For | |----------|-------------------|------------------| | JavaScript | `db.query("SELECT * FROM users WHERE id=" + req.params.id)` | String concatenation in SQL queries | | JavaScript | `` eval(`${userInput}`) `` | Dynamic code execution with user data | | Python | `cursor.execute("SELECT * FROM users WHERE id=%s" % user_id)` | String formatting in SQL | | Python | `os.system(f"ping {hostname}")` | Command injection via f-strings or format() | | Go | `db.Query("SELECT * FROM users WHERE id=" + id)` | String concat in database calls | | Java | `stmt.execute("SELECT * FROM users WHERE id=" + id)` | Non-parameterized queries | | SQL | Stored procedures using `EXEC(@dynamic_sql)` | Dynamic SQL construction | **Also check for:** - Template injection (Jinja2, Handlebars, EJS with unescaped output) - LDAP injection in directory queries - XML injection / XXE in parsers without disabled external entities - NoSQL injection (`$where`, `$regex` in MongoDB queries) - Path traversal (`../` in file paths derived from user input) ### A02: Broken Authentication Detect weak authentication implementations. **Patterns to detect:** - Passwords stored in plaintext or with weak hashing (MD5, SHA1 without salt) - Missing rate limiting on login endpoints - Session tokens in URLs or query parameters - JWT with `alg: "none"` accepted or HS256 with weak secrets - Missing token expiration (`exp` claim absent) - Credentials transmitted over HTTP (not HTTPS) - Default or hardcoded credentials in source code - Missing multi-factor authentication on sensitive operations - Session fixation (session ID not rotated after login) ### A03: Sensitive Data Exposure Detect exposure of secrets, PII, or sensitive configuration. **Patterns to detect:** - API keys, tokens, passwords in source code (regex: `(?i)(api[_-]?key|secret|password|token|auth)\s*[:=]\s*["'][^"']{8,}["']`) - `.env` files committed to version control - Credentials in `docker-compose.yml`, `Dockerfile`, CI/CD configs - Logging of sensitive data (`console.log(password)`, `logger.info(f"token={token}")`) - PII in error messages or stack traces returned to clients - Sensitive data in URL query parameters - Missing encryption at rest for database fields containing PII - Overly verbose error responses in production mode ### A04: XML External Entities (XXE) Detect unsafe XML parsing. **Patterns to detect:** - XML parsers without disabled external entity processing - Python: `etree.parse()` without `defusedxml` - Java: `DocumentBuilderFactory` without `setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)` - Go: `xml.NewDecoder()` without entity limits - XSLT processing with user-controlled stylesheets ### A05: Broken Access Control Detect missing or flawed authorization checks. **Patterns to detect:** - Endpoints without authentication middleware - Missing ownership checks (user A accessing user B's data via predictable IDs) - Direct object references without authorization (`/api/users/123/profile`) - Missing role-based access control on admin endpoints - CORS with `Access-Control-Allow-Origin: *` on authenticated endpoints - File upload without type/size validation - Directory listing enabled - Missing `X-Frame-Options` or CSP `frame-ancestors` (clickjacking) ### A06: Security Misconfiguration Detect dangerous default or debug configurations. **Patterns to detect:** - `DEBUG=True` or `NODE_ENV=development` in production configs - Default admin credentials - Stack traces or debug info in error responses - Directory listing enabled in web server config - Unnecessary HTTP methods allowed (TRACE, OPTIONS without restriction) - Missing security headers (HSTS, CSP, X-Content-Type-Options) - Cloud storage buckets with public access - Default CORS allowing all origins ### A07: Cross-Site Scripting (XSS) Detect XSS vulnerabilities in web applications. **Patterns to detect:** | Type | Pattern | Example | |------|---------|---------| | Reflected | User input rendered without escaping | `res.send("

" + req.query.name + "

")` | | Stored | Database content rendered without sanitization | `innerHTML = post.body` | | DOM-based | Client-side JS using `document.location`, `document.URL` unsafely | `document.getElementById("x").innerHTML = location.hash` | **Framework-specific:** - React: `dangerouslySetInnerHTML` with unsanitized data - Angular: `bypassSecurityTrustHtml()` usage - Vue: `v-html` with user-controlled data - EJS/Handlebars: `<%- %>` or `{{{ }}}` (unescaped output) - Jinja2: `| safe` filter on user data ### A08: Insecure Deserialization Detect unsafe deserialization of untrusted data. **Patterns to detect:** - Python: `pickle.loads()` on user input, `yaml.load()` without `Loader=SafeLoader` - Java: `ObjectInputStream.readObject()` on untrusted data - JavaScript: `JSON.parse()` without validation (less severe but check what follows) - Ruby: `Marshal.load()` on external data - PHP: `unserialize()` on user input ### A09: Using Components with Known Vulnerabilities Detect outdated or vulnerable dependencies. **Patterns to detect:** - `package.json` / `package-lock.json` with outdated packages - `requirements.txt` without pinned versions - Known CVEs in declared dependencies (flag for manual check) - `go.mod` with old versions of common libraries - Dockerfile `FROM` using `latest` tag instead of pinned version - Git submodules pointing to old commits ### A10: Insufficient Logging and Monitoring Detect missing audit trails and monitoring gaps. **Patterns to detect:** - Authentication events not logged (login, logout, failed attempts) - Authorization failures not logged - Input validation failures not logged - No structured logging (using `console.log` instead of proper logger) - Sensitive data in logs (passwords, tokens, PII) - Missing request correlation IDs - No error alerting mechanism - Catch blocks that swallow exceptions silently --- ## Severity Levels | Level | Description | Response Time | |-------|-------------|---------------| | **Critical** | Actively exploitable, direct data breach or RCE possible | Immediate fix required | | **High** | Exploitable with some effort, significant data at risk | Fix within 24 hours | | **Medium** | Requires specific conditions to exploit, moderate impact | Fix within 1 week | | **Low** | Minor risk, defense-in-depth improvement | Fix within 1 month | | **Info** | Best practice recommendation, no direct vulnerability | Backlog | --- ## Output Format For each finding, produce: ``` ### [SEVERITY] Finding Title **Category:** OWASP A0X — Category Name **Location:** `path/to/file.js:42` **Language:** JavaScript **Issue:** Brief description of what is wrong and why it is dangerous. **Vulnerable Code:** ```language // The problematic code ``` **Impact:** What an attacker could do if this is exploited. **Fix:** ```language // The corrected code with explanation ``` **References:** - Link to relevant CWE or documentation ``` --- ## Environment and Secrets Detection ### Files to Flag Immediately - `.env`, `.env.local`, `.env.production`, `.env.staging` - `credentials.json`, `service-account.json` - `*.pem`, `*.key`, `*.p12`, `*.pfx` (private keys) - `id_rsa`, `id_ed25519` (SSH keys) - `.npmrc` with `_authToken` - `.pypirc` with passwords - `wp-config.php`, `database.yml` with plaintext credentials - AWS `credentials` file, `config` with access keys - `.docker/config.json` with auth tokens ### Regex Patterns for Secret Detection ``` # AWS Access Key AKIA[0-9A-Z]{16} # AWS Secret Key (?i)aws_secret_access_key\s*[:=]\s*[A-Za-z0-9/+=]{40} # GitHub Token gh[ps]_[A-Za-z0-9_]{36,} # Generic API Key/Secret (?i)(api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token|secret[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9_\-]{20,}["']? # Private Key Block -----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY----- # Database Connection String with Password (?i)(mongodb|postgres|mysql|redis):\/\/[^:]+:[^@]+@ # Slack Token xox[bporas]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,34} # Stripe Key sk_live_[0-9a-zA-Z]{24,} # SendGrid Key SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43} ``` --- ## Dependency Vulnerability Awareness When you encounter dependency manifests, flag: 1. **package.json** -- Check for known-vulnerable packages. Flag if `npm audit` should be run. 2. **requirements.txt** -- Flag unpinned versions (`requests` vs `requests==2.31.0`). Recommend `pip-audit`. 3. **go.mod** -- Flag outdated stdlib usage. Recommend `govulncheck`. 4. **Cargo.toml** -- Flag old versions. Recommend `cargo audit`. 5. **pom.xml / build.gradle** -- Flag known vulnerable Java libraries (Log4j, Spring, Jackson). --- ## Language-Specific Checklists ### JavaScript / TypeScript - [ ] No `eval()`, `Function()`, or `setTimeout(string)` with user input - [ ] No `innerHTML` or `dangerouslySetInnerHTML` with unsanitized data - [ ] Parameterized queries for all database operations - [ ] `helmet` or equivalent security headers middleware - [ ] Input validation with schema validation (Zod, Joi, Yup) - [ ] CSRF tokens on state-changing endpoints - [ ] `httpOnly`, `secure`, `sameSite` flags on cookies ### Python - [ ] No `eval()`, `exec()`, `os.system()`, `subprocess.call(shell=True)` with user input - [ ] Parameterized queries (`%s` placeholders, not f-strings) for database calls - [ ] `defusedxml` instead of stdlib XML parsers - [ ] `yaml.safe_load()` instead of `yaml.load()` - [ ] No `pickle.loads()` on untrusted data - [ ] Django/Flask CSRF protection enabled - [ ] `SECRET_KEY` not hardcoded ### Go - [ ] No `fmt.Sprintf` in SQL queries -- use parameterized queries - [ ] `html/template` (auto-escaping) instead of `text/template` - [ ] Context timeouts on HTTP requests and database calls - [ ] Input validation before processing - [ ] TLS configuration with minimum version TLS 1.2 - [ ] No `unsafe` package usage without justification ### Rust - [ ] Minimize `unsafe` blocks, justify each one - [ ] No raw SQL string construction -- use query builders - [ ] Validate all external input at system boundaries - [ ] Check for integer overflow in arithmetic with untrusted values - [ ] Use `secrecy` crate for sensitive values in memory ### Java - [ ] No `Runtime.exec()` with user input - [ ] PreparedStatement for all SQL operations - [ ] XML parsers with XXE protection enabled - [ ] `ObjectInputStream` restricted with allowlists - [ ] Spring Security configured with CSRF, CORS, headers - [ ] No `System.out.println` for logging in production --- ## Audit Summary Template At the end of every audit, produce a summary: ``` ## Security Audit Summary **Target:** [repository/file/PR name] **Date:** [audit date] **Auditor:** sovereign-security-auditor v1.0.0 ### Findings Overview | Severity | Count | |----------|-------| | Critical | X | | High | X | | Medium | X | | Low | X | | Info | X | ### Top Priorities 1. [Most critical finding] 2. [Second most critical] 3. [Third most critical] ### Positive Observations - [Things done well] ### Recommendations - [Strategic improvements] ``` --- ## Installation ```bash clawhub install sovereign-security-auditor ``` ## License MIT --- > Source: [modbender/skill-library-mcp](https://github.com/modbender/skill-library-mcp) — distributed by [TomeVault](https://tomevault.io).