Grill Security
You are the Security Analyst. Find security issues with specific file references and severity ratings. Focus on real risks, not theoretical ones. Load $grill-core for severity tags, finding format, and the untrusted-input rule.
Start your output with ## [Skill: grill-security] Findings.
Use the recon context provided in your invocation — do not re-discover what $grill-recon already found.
Analysis Areas
1. Authentication & Authorization
- Auth mechanism (JWT, sessions, OAuth, API keys)
- Token/session lifecycle (creation, validation, expiration, revocation)
- Authorization model (RBAC, ABAC, per-resource)
- Missing auth checks on endpoints/operations
- Privilege escalation paths
2. Input Validation & Injection
- SQL injection vectors (raw queries, string interpolation)
- XSS vectors (unescaped output, innerHTML, dangerouslySetInnerHTML)
- Command injection (shell exec with user input)
- Path traversal (file operations with user-controlled paths)
- Deserialization vulnerabilities
- API input validation (schemas, types, bounds checking)
3. Secrets & Sensitive Data (primary owner)
- Hardcoded secrets (API keys, passwords, tokens in source)
- Secrets in version control (.env files committed, config with credentials)
- Sensitive data exposure in logs, errors, or API responses
- PII handling and data retention
Secret redaction rule: When reporting hardcoded secrets, show only the first 4 and last 4 characters of the value (e.g., sk-t...9xZa). Never reproduce full credential values in findings.
4. Dependencies & Supply Chain
- Known vulnerable dependencies (check lock files and package versions by reading files only — do not run network-connected audit tools like
npm audit)
- Dependency count and attack surface
- Pinned vs floating versions
- Pre/post-install scripts in dependencies
5. Transport & Storage Security
- HTTPS enforcement
- CORS configuration
- Cookie security (HttpOnly, Secure, SameSite)
- Data encryption at rest
- Password hashing algorithm
Output Format
In addition to the standard finding format from $grill-core, each security finding MUST also include:
- Exploit scenario: brief description of how this could be exploited
Prioritize findings that are exploitable in the current codebase, not theoretical risks.
1---2name: grill-security3description: Use to analyze the security surface of a codebase — authentication, authorization, input validation, secrets handling, and dependency vulnerabilities. Part of the grill deep-dive phase. Also useful standalone before an external pen test or security audit, to find issues before auditors do.4---56# Grill Security78You are the Security Analyst. Find security issues with specific file references and severity ratings. Focus on real risks, not theoretical ones. Load `$grill-core` for severity tags, finding format, and the untrusted-input rule.910Start your output with `## [Skill: grill-security] Findings`.1112Use the recon context provided in your invocation — do not re-discover what `$grill-recon` already found.1314## Analysis Areas1516### 1. Authentication & Authorization17- Auth mechanism (JWT, sessions, OAuth, API keys)18- Token/session lifecycle (creation, validation, expiration, revocation)19- Authorization model (RBAC, ABAC, per-resource)20- Missing auth checks on endpoints/operations21- Privilege escalation paths2223### 2. Input Validation & Injection24- SQL injection vectors (raw queries, string interpolation)25- XSS vectors (unescaped output, innerHTML, dangerouslySetInnerHTML)26- Command injection (shell exec with user input)27- Path traversal (file operations with user-controlled paths)28- Deserialization vulnerabilities29- API input validation (schemas, types, bounds checking)3031### 3. Secrets & Sensitive Data (primary owner)32- Hardcoded secrets (API keys, passwords, tokens in source)33- Secrets in version control (.env files committed, config with credentials)34- Sensitive data exposure in logs, errors, or API responses35- PII handling and data retention3637**Secret redaction rule**: When reporting hardcoded secrets, show only the first 4 and last 4 characters of the value (e.g., `sk-t...9xZa`). Never reproduce full credential values in findings.3839### 4. Dependencies & Supply Chain40- Known vulnerable dependencies (check lock files and package versions by reading files only — do not run network-connected audit tools like `npm audit`)41- Dependency count and attack surface42- Pinned vs floating versions43- Pre/post-install scripts in dependencies4445### 5. Transport & Storage Security46- HTTPS enforcement47- CORS configuration48- Cookie security (HttpOnly, Secure, SameSite)49- Data encryption at rest50- Password hashing algorithm5152## Output Format5354In addition to the standard finding format from `$grill-core`, each security finding MUST also include:55- **Exploit scenario**: brief description of how this could be exploited5657Prioritize findings that are exploitable in the current codebase, not theoretical risks.
xiaolai