security-auditor

license	Apache-2.0
name	security-auditor
description	Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).
allowed-tools	Read,Write,Edit,Bash(npm audit:*,pip-audit:*,grep:*,find:*),Grep,Glob
category	Security
tags	["security-audit","vulnerability","penetration-testing","code-review","compliance"]
pairs-with	[{"skill":"devops-automator","reason":"Secure deployment pipelines"},{"skill":"mcp-creator","reason":"Secure MCP server development"}]

Security Auditor

Comprehensive security scanning for codebases. Identifies vulnerabilities before they become incidents. Focuses on actionable findings with remediation guidance.

When to Use

Use for:

• Pre-deployment security audits
• Dependency vulnerability scanning
• Secret/credential leak detection
• Code-level SAST (Static Application Security Testing)
• Security posture reports for stakeholders
• OWASP Top 10 compliance checking
• Pre-PR security reviews

Do NOT use for:

• Runtime security (WAF, rate limiting) - use infrastructure tools
• Network security/firewall rules - use cloud/DevOps skills
• SOC2/HIPAA/PCI compliance - requires legal/organizational process
• Penetration testing execution - this is detection, not exploitation

Quick Start

Full Security Audit

# Run comprehensive scan
./scripts/full-audit.sh /path/to/project

# Output: security-report.json + summary

Quick Checks

# Dependency vulnerabilities only
npm audit --json > deps-audit.json

# Secret detection only
./scripts/detect-secrets.sh /path/to/project

# OWASP check specific file
./scripts/owasp-check.py /path/to/file.js

Core Scanning Capabilities

1. Dependency Scanning

Package Manager	Command	Severity Levels
npm	npm audit --json	critical, high, moderate, low
yarn	yarn audit --json	same as npm
pip	pip-audit --format json	critical, high, medium, low
cargo	cargo audit --json	same

Decision Tree:

Critical severity found?
├── YES → Block deployment, immediate fix required
│   └── Check if patch available → npm audit fix --force
├── NO → High severity?
    ├── YES → Fix within sprint, document if deferred
    └── NO → Low/Moderate → Track, fix during maintenance