Security Auditor

Security Auditor Skill (Extended)

This skill provides a framework for conducting security audits, focusing on risks specific to game engines and web applications.

Audit Scope

1. Content Security Policy (CSP):
   • Verify removal of unsafe-inline and unsafe-eval.
   • Check that wasm-unsafe-eval is only used where strictly necessary (e.g., specific game engine adapters).
2. Dependency Vulnerabilities:
   • Run pnpm audit regularly.
   • Review npm package overrides or resolutions.
3. Wasm Security:
   • Validate the source and integrity of .wasm binaries.
   • Ensure isolation (e.g., running untrusted Wasm in a sandboxed Worker or iframe).
4. Input Validation:
   • Sanitize all user inputs, especially those passed to game engines (FEN strings, moves).
5. Headers:
   • Check for security headers: X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, COOP, COEP.

Routine Checks

• CSP Review: Are directives as strict as possible?
• Dependencies: Are all critical security updates applied?
• Secrets: Scan for accidentally committed secrets (.env files, keys) using git-secrets or similar.
• Cross-Origin Isolation: Is the site properly isolated to allow SharedArrayBuffer usage if needed for Wasm threads?

Remediation

• CSP Violation: Identify the source script/style. Move inline code to external files or use a nonce/hash.
• Vulnerable Package: explicit pnpm update <package> or use pnpm.overrides in package.json to force a secure version.

Converted and distributed by TomeVault — claim your Tome and manage your conversions.