# Security Auditor

> Audits code for security vulnerabilities including OWASP Top 10 and authentication issues. Use when this capability is needed.

- Skill: `tomevault-io/security-auditor` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/security-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-auditor/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/security-auditor

---


# Security Auditor

Agent สำหรับตรวจสอบ security vulnerabilities ตาม OWASP Top 10 และ best practices

## Purpose

- ตรวจหา security vulnerabilities
- ตรวจสอบ OWASP Top 10 risks
- วิเคราะห์ authentication และ authorization
- ตรวจสอบ data protection
- หา hardcoded secrets

## When to Use

- ก่อน push code ไป production
- Periodic security audit
- เมื่อเพิ่ม feature เกี่ยวกับ auth/data
- หลังจาก code review พบ potential issues

## Instructions

### Step 1: Identify Scope

```bash
find . -type f \( -name "*.js" -o -name "*.ts" -o -name "*.py" -o -name "*.go" \) | head -50
# Or changed files only
git diff --name-only HEAD
```

### Step 2: OWASP Top 10 Checklist

#### A01: Broken Access Control
- [ ] Authorization checks on all endpoints
- [ ] No direct object references exposed
- [ ] CORS properly configured
- [ ] Directory traversal prevention

#### A02: Cryptographic Failures
- [ ] No sensitive data in plain text
- [ ] Strong encryption algorithms used
- [ ] Secure key management
- [ ] HTTPS enforced

#### A03: Injection
- [ ] SQL injection prevention (parameterized queries)
- [ ] NoSQL injection prevention
- [ ] Command injection prevention
- [ ] LDAP injection prevention

#### A04: Insecure Design
- [ ] Threat modeling done
- [ ] Security requirements defined
- [ ] Fail-safe defaults

#### A05: Security Misconfiguration
- [ ] Default credentials changed
- [ ] Unnecessary features disabled
- [ ] Error messages don't leak info
- [ ] Security headers present

#### A06: Vulnerable Components
- [ ] Dependencies up to date
- [ ] No known vulnerabilities in deps
- [ ] Minimal dependencies

#### A07: Authentication Failures
- [ ] Strong password policy
- [ ] Brute force protection
- [ ] Secure session management
- [ ] MFA support (if applicable)

#### A08: Software & Data Integrity
- [ ] Integrity verification for updates
- [ ] CI/CD pipeline secured
- [ ] Unsigned/untrusted data rejected

#### A09: Logging & Monitoring
- [ ] Security events logged
- [ ] No sensitive data in logs
- [ ] Log injection prevention
- [ ] Alerting configured

#### A10: Server-Side Request Forgery (SSRF)
- [ ] URL validation
- [ ] Allowlist for external requests
- [ ] No user-controlled redirects

### Step 3: Secrets Detection

```bash
grep -r "password\|secret\|api_key\|token\|credential" --include="*.js" --include="*.ts" --include="*.py" --include="*.go" .
```

Look for:
- Hardcoded passwords
- API keys in code
- Private keys
- Connection strings with credentials

### Step 4: Risk Assessment

| Risk Level | Criteria |
|------------|----------|
| Critical | Exploitable, high impact |
| High | Exploitable, medium impact |
| Medium | Requires conditions to exploit |
| Low | Minimal impact |

## Output Format

```markdown
## Security Audit Report

**Scope:** [files/directories audited]
**Date:** YYYY-MM-DD
**Risk Level:** [CRITICAL/HIGH/MEDIUM/LOW]

---

### Executive Summary

| Severity | Count |
|----------|-------|
| Critical | X |
| High | Y |
| Medium | Z |
| Low | W |

---

### [VULN-001] [Vulnerability Name]
- **File:** `path/to/file.js:123`
- **Type:** [OWASP Category]
- **Description:** What the vulnerability is
- **Impact:** What could happen if exploited
- **Remediation:** How to fix it

---

### Recommendations

1. **Immediate:** [Critical fixes]
2. **Short-term:** [High priority improvements]
3. **Long-term:** [Security enhancements]
```

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/goffity) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-15 -->