security-audit

Name: security-audit
Author: neuromechanist

37stars7forks

How to install security-audit?

neuromechanist/research-skills/security-audit

$npx -y skills add neuromechanist/research-skills --skill security-audit

Installs into the current project.

Summary

This skill should be used when the user says \"security audit\", \"check for vulnerabilities\", \"security review\", \"harden project\", \"dependency audit\", \"credential scan\", \"check for secrets\", \"scan for secrets\", \"OWASP review\", \"security checklist\", \"audit depen

Files · 1

View on GitHub

SKILL.md

1	# Security Audit
2
3	Systematic security review of a project covering dependency vulnerabilities, credential exposure, common code vulnerabilities, and configuration hardening.
4
5	## When to Use
6
7	- Before a release or deployment
8	- After adding new dependencies
9	- When onboarding to a new codebase
10	- Periodic security reviews
11	- After receiving a vulnerability report
12
13	## Audit Checklist
14
15	### 1. Credential and Secret Scanning
16
17	Check for exposed secrets in the codebase:
18
19	```bash
20	# Check for common secret patterns in tracked files
21	git grep -n -i -E '(api_key\|apikey\|secret\|password\|token\|credential\|private_key)\s[:=]' -- ':!.md' ':!*.lock'
22
23	# Check for .env files tracked in git
24	git ls-files \| grep -i '\.env'
25
26	# Check .gitignore covers sensitive files
27	for f in .env .env.local credentials.json secrets.yaml; do
28	git check-ignore "$f" 2>/dev/null \|\| echo "WARNING: $f not in .gitignore"
29	done
30	```
31
32	Files that must never be committed:
33	- `.env`, `.env.*` (environment variables)
34	- `credentials.json`, `service-account.json` (cloud credentials)
35	- `.pem`, `.key` (private keys)
36	- `.p12`, `.pfx` (certificates with private keys)
37
38	### 2. Dependency Vulnerability Scan
39
40	Python:
41	```bash
42	uv run pip-audit
43	```
44
45	JavaScript/TypeScript:
46	```bash
47	bun pm audit
48	# or check with npm for broader database
49	npm audit --omit=dev
50	```
51
52	Go:
53	```bash
54	govulncheck ./...
55	```
56
57	Review results against the severity rubric (shared with the
58	dependency-auditor agent):
59
60	- Critical: exploitable now or actively exploited (leaked live credential,
61	known-exploited CVE in a reachable path). Must fix before release; blocks
62	release-prep.
63	- High: known vulnerability with a plausible attack path. Fix before the next
64	release.
65	- Medium: vulnerability with mitigating factors, or a major-version lag on a
66	security-relevant package. Fix within the sprint.
67	- Low: outdated without known vulnerabilities; license concerns to review.
68	Track in backlog.
69
70	### 3. Code Vulnerability Patterns
71
72	Scan for common vulnerability patterns:
73
74	SQL Injection:
75	```bash
76	# Look for string interpolation in SQL
77	grep -rn 'f".SELECT\\|f".INSERT\\|f".UPDATE\\|f".DELETE' --include='*.py'
78	grep -rn "format.SELECT\\|format.INSERT" --include='*.py'
79	```
80
81	Command Injection:
82	```bash
83	# Look for shell=True or unsanitized subprocess calls
84	grep -rn 'shell=True\\|os\.system\\|subprocess\.call.shell' --include='.py'
85	grep -rn 'exec(\\|eval(' --include='.py' --include='.js' --include='*.ts'
86	```
87
88	XSS (Cross-Site Scripting):
89	```bash
90	# Look for dangerouslySetInnerHTML or unescaped output
91	grep -rn 'dangerouslySetInnerHTML\\|innerHTML\s=' --include='.tsx' --include='.jsx' --include='.ts' --include='*.js'
92	```
93
94	Path Traversal:
95	```bash
96	grep -rn 'open(.\+\\|os\.path\.join.input\\|req\.$params\\|query\\|body$' --include='.py' --include='.js'
97	```
98
99	### 4. Authentication and Authorization
100
101	Review:
102	- [ ] Authentication endpoints use constant-time comparison for secrets
103	- [ ] Session tokens have appropriate expiration
104	- [ ] CORS configuration is restrictive (not `*` in production)
105	- [ ] Rate limiting on auth endpoints
106	- [ ] Password hashing uses bcrypt/argon2 (not MD5/SHA1)
107
108	### 5. Configuration Hardening
109
110	- [ ] Debug mode disabled in production configs
111	- [ ] HTTPS enforced (HSTS headers)
112	- [ ] Security headers present (CSP, X-Frame-Options, X-Content-Type-Options)
113	- [ ] Error messages do not leak stack traces in production
114	- [ ] Logging does not include sensitive data (passwords, tokens)
115
116	### 6. Docker Security (if applicable)
117
118	- [ ] Non-root user in Dockerfile
119	- [ ] Base image is pinned to specific version (not `latest`)
120	- [ ] No secrets in Docker build args or layers
121	- [ ] Health checks configured
122	- [ ] Read-only filesystem where possible
123
124	### 7. CI/CD Security
125
126	- [ ] Secrets stored in GitHub Secrets (not in workflow files)
127	- [ ] Third-party actions pinned to SHA (not tags)
128	- [ ] Minimal permissions in workflow `permissions:` block
129	- [ ] No `pull_request_target` with `actions/checkout` of PR head
130
131	## Output Format
132
133	Present findings as a prioritized list:
134
135	```
136	## Security Audit Results
137
138	### Critical (must fix)
139	1. [CRED] API key found in src/config.py:42 - move to environment variable
140	2. [DEP] lodash 4.17.20 has prototype pollution (CVE-2021-23337)
141
142	### High (fix before release)
143	3. [CODE] SQL injection risk in src/db.py:88 - use parameterized queries
144
145	### Medium (fix within sprint)
146	4. [CONFIG] CORS allows * origin in production config
147
148	### Low (backlog)
149	5. [STYLE] Error responses include stack traces in non-debug mode
150
151	### P

People who liked this also viewed

6 picks

Type

security-audit

37stars7forks

View on GitHub

How to install security-audit?

neuromechanist/research-skills/security-audit

$npx -y skills add neuromechanist/research-skills --skill security-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Security Audit
2
3	Systematic security review of a project covering dependency vulnerabilities, credential exposure, common code vulnerabilities, and configuration hardening.
4
5	## When to Use
6
7	- Before a release or deployment
8	- After adding new dependencies
9	- When onboarding to a new codebase
10	- Periodic security reviews
11	- After receiving a vulnerability report
12
13	## Audit Checklist
14
15	### 1. Credential and Secret Scanning
16
17	Check for exposed secrets in the codebase:
18
19	```bash
20	# Check for common secret patterns in tracked files
21	git grep -n -i -E '(api_key\|apikey\|secret\|password\|token\|credential\|private_key)\s[:=]' -- ':!.md' ':!*.lock'
22
23	# Check for .env files tracked in git
24	git ls-files \| grep -i '\.env'
25
26	# Check .gitignore covers sensitive files
27	for f in .env .env.local credentials.json secrets.yaml; do
28	git check-ignore "$f" 2>/dev/null \|\| echo "WARNING: $f not in .gitignore"
29	done
30	```
31
32	Files that must never be committed:
33	- `.env`, `.env.*` (environment variables)
34	- `credentials.json`, `service-account.json` (cloud credentials)
35	- `.pem`, `.key` (private keys)
36	- `.p12`, `.pfx` (certificates with private keys)
37
38	### 2. Dependency Vulnerability Scan
39
40	Python:
41	```bash
42	uv run pip-audit
43	```
44
45	JavaScript/TypeScript:
46	```bash
47	bun pm audit
48	# or check with npm for broader database
49	npm audit --omit=dev
50	```
51
52	Go:
53	```bash
54	govulncheck ./...
55	```
56
57	Review results against the severity rubric (shared with the
58	dependency-auditor agent):
59
60	- Critical: exploitable now or actively exploited (leaked live credential,
61	known-exploited CVE in a reachable path). Must fix before release; blocks
62	release-prep.
63	- High: known vulnerability with a plausible attack path. Fix before the next
64	release.
65	- Medium: vulnerability with mitigating factors, or a major-version lag on a
66	security-relevant package. Fix within the sprint.
67	- Low: outdated without known vulnerabilities; license concerns to review.
68	Track in backlog.
69
70	### 3. Code Vulnerability Patterns
71
72	Scan for common vulnerability patterns:
73
74	SQL Injection:
75	```bash
76	# Look for string interpolation in SQL
77	grep -rn 'f".SELECT\\|f".INSERT\\|f".UPDATE\\|f".DELETE' --include='*.py'
78	grep -rn "format.SELECT\\|format.INSERT" --include='*.py'
79	```
80
81	Command Injection:
82	```bash
83	# Look for shell=True or unsanitized subprocess calls
84	grep -rn 'shell=True\\|os\.system\\|subprocess\.call.shell' --include='.py'
85	grep -rn 'exec(\\|eval(' --include='.py' --include='.js' --include='*.ts'
86	```
87
88	XSS (Cross-Site Scripting):
89	```bash
90	# Look for dangerouslySetInnerHTML or unescaped output
91	grep -rn 'dangerouslySetInnerHTML\\|innerHTML\s=' --include='.tsx' --include='.jsx' --include='.ts' --include='*.js'
92	```
93
94	Path Traversal:
95	```bash
96	grep -rn 'open(.\+\\|os\.path\.join.input\\|req\.$params\\|query\\|body$' --include='.py' --include='.js'
97	```
98
99	### 4. Authentication and Authorization
100
101	Review:
102	- [ ] Authentication endpoints use constant-time comparison for secrets
103	- [ ] Session tokens have appropriate expiration
104	- [ ] CORS configuration is restrictive (not `*` in production)
105	- [ ] Rate limiting on auth endpoints
106	- [ ] Password hashing uses bcrypt/argon2 (not MD5/SHA1)
107
108	### 5. Configuration Hardening
109
110	- [ ] Debug mode disabled in production configs
111	- [ ] HTTPS enforced (HSTS headers)
112	- [ ] Security headers present (CSP, X-Frame-Options, X-Content-Type-Options)
113	- [ ] Error messages do not leak stack traces in production
114	- [ ] Logging does not include sensitive data (passwords, tokens)
115
116	### 6. Docker Security (if applicable)
117
118	- [ ] Non-root user in Dockerfile
119	- [ ] Base image is pinned to specific version (not `latest`)
120	- [ ] No secrets in Docker build args or layers
121	- [ ] Health checks configured
122	- [ ] Read-only filesystem where possible
123
124	### 7. CI/CD Security
125
126	- [ ] Secrets stored in GitHub Secrets (not in workflow files)
127	- [ ] Third-party actions pinned to SHA (not tags)
128	- [ ] Minimal permissions in workflow `permissions:` block
129	- [ ] No `pull_request_target` with `actions/checkout` of PR head
130
131	## Output Format
132
133	Present findings as a prioritized list:
134
135	```
136	## Security Audit Results
137
138	### Critical (must fix)
139	1. [CRED] API key found in src/config.py:42 - move to environment variable
140	2. [DEP] lodash 4.17.20 has prototype pollution (CVE-2021-23337)
141
142	### High (fix before release)
143	3. [CODE] SQL injection risk in src/db.py:88 - use parameterized queries
144
145	### Medium (fix within sprint)
146	4. [CONFIG] CORS allows * origin in production config
147
148	### Low (backlog)
149	5. [STYLE] Error responses include stack traces in non-debug mode
150
151	### P

People who liked this also viewed

6 picks

Type