| name | security-audit |
| description | Run a security audit (dependencies, secrets, auth, inputs). Use when the user asks for a security review, dependency audit, or to check for vulnerabilities and hardcoded secrets. |
Security Audit
When the user asks for a security audit or review, follow this workflow.
1. Determine scope
- Full audit → Do all steps below (dependencies, secrets, auth, inputs, report).
- Quick check (e.g. before PR) → Run only Secrets and Dependencies from reference.md.
Ask or infer from the request; if unclear, do a quick check and offer to run a full audit.
2. Full audit steps
- Dependencies — Check for known vulnerabilities (e.g.
npm audit, pip audit, or project-equivalent). List high/critical and suggest upgrades or mitigations.
- Secrets — Search for hardcoded secrets, API keys, passwords. See reference.md for patterns and paths to exclude.
- Auth and authorization — Identify auth boundaries; note any endpoints that should require auth but don’t, or missing role checks.
- Inputs — Note places that accept user/s external input (forms, API params, file upload). Ensure validation and sanitization are present; flag SQL/command injection or XSS risks where relevant.
- Report — Summarize findings using the severity format in examples.md: Critical / High / Medium / Low, with file/line or area and a short recommendation.
3. Output format
Use the same severity labels and structure as in examples.md so the report is consistent and actionable.
Additional resources
