STRIDE + OWASP-based security audit with optional red-team persona discovery loop and auto-fix. Scans code for vulnerabilities from multiple attacker perspectives (auth attacker, supply chain, insider, infrastructure), categorizes by severity, and can iteratively fix findings using ak:autoresearch pattern.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
STRIDE + OWASP-based security audit with optional red-team persona discovery loop and auto-fix. Scans code for vulnerabilities from multiple attacker perspectives (auth attacker, supply chain, insider, infrastructure), categorizes by severity, and can iteratively fix findings using ak:autoresearch pattern.
user-invocable
true
when_to_use
Invoke for threat-modeled security audit or auto-fix loops.
<scope glob or 'full'> [--fix] [--red-team] [--iterations N]
metadata
{"author":"agentkit","attribution":"Security audit pattern adapted from autoresearch by Udit Goenka (MIT)","license":"MIT","version":"1.0.0"}
ak:security — Security Audit
Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With --fix, applies fixes iteratively using the ak:autoresearch guard pattern.
When to Use
Before a release or major deployment
After adding auth, payment, or data-handling features
Periodic security review (monthly/quarterly)
Compliance check (SOC 2, GDPR, PCI-DSS prep)
When NOT to Use
Purely cosmetic changes (CSS, copy edits)
No user-facing code or data handling involved
Modes
Mode
Invocation
Behavior
Audit only
/ak:security <scope>
Scan → categorize → report (one-shot)
Red-team discovery
/ak:security <scope> --red-team
Iterate 4 attacker personas → STRIDE/OWASP sweep → report
Bounded red-team
/ak:security <scope> --red-team --iterations N
Cap persona discovery to N iterations total
Audit + Fix
/ak:security <scope> --fix
Scan → categorize → fix iteratively
Red-team + Fix
/ak:security <scope> --red-team --fix
Full persona discovery → fix confirmed Critical/High
Bounded fix
/ak:security <scope> --fix --iterations N
Limit fix iterations to N
Audit Methodology
1. Scope Resolution
Expand the provided glob or full keyword into a file list. Read all in-scope files before analysis.
2. STRIDE Analysis
Evaluate each threat category systematically:
Spoofing — identity/authentication weaknesses
Tampering — input validation, integrity controls
Repudiation — audit logging gaps
Information Disclosure — data leakage, secret exposure
Denial of Service — rate limits, resource exhaustion
Elevation of Privilege — broken access control, RBAC gaps
3. OWASP Top 10 Check
Map findings to OWASP categories (A01–A10). See references/stride-owasp-checklist.md for per-category checks.
4. Dependency Audit
Run the appropriate package audit tool for the detected stack:
Node.js: npm audit
Python: pip-audit
Go: govulncheck
Ruby: bundle audit
5. Secret Detection
Scan for hardcoded API keys, passwords, tokens, and private keys using regex patterns. See references/stride-owasp-checklist.md → Secret Patterns.
6. Finding Categorization
Assign each finding a severity level (see Severity Definitions below).
Output Format
## Security Audit Report
### Summary
- Files scanned: N
- Findings: X critical, Y high, Z medium, W low, V info
### Findings
| # | Severity | Category | File:Line | Description | Fix Recommendation |
|---|----------|----------|-----------|-------------|-------------------|
| 1 | Critical | Injection | api/users.ts:45 | SQL string concatenation | Use parameterized queries |
| 2 | High | Auth | auth/login.ts:12 | No rate limiting | Add express-rate-limit |
Red-Team Discovery Mode (--red-team)
When --red-team is provided, the audit runs a multi-persona iterative discovery loop before (or instead of) the standard one-shot STRIDE/OWASP sweep. Each persona represents a distinct attacker mindset with its own threat model and probe targets.
Each persona phase follows the autoresearch iteration protocol:
Select next untested attack vector from persona's probe list
Assume that attacker's mindset — reason as adversary, not defender
Probe relevant code, trace data flows, find missing guards
Validate with proof (file:line, attack scenario, impact)
Log to security-audit-results.tsv with persona column
Chain: prior persona findings compound into later phases
After all 4 personas complete, a standard STRIDE/OWASP sweep fills remaining coverage gaps.
See references/red-team-personas.md for the full persona catalog: threat models, typical attack vectors, and per-persona probe checklists.
Credential Hygiene (Mandatory)
All findings across every persona MUST mask secret values before logging. Never emit raw JWTs (eyJ...), 32+ char hex strings, AWS key prefixes (AKIA, ASIA), or connection strings with embedded passwords. Use <REDACTED_TOKEN>, <REDACTED_PASSWORD>, or reference the env var name only.
Fix Mode (--fix)
When --fix is provided, apply fixes iteratively after the audit:
Sort all findings by severity (Critical → High → Medium → Low)
For each finding:
a. Apply one targeted fix
b. Run guard (tests or lint) to verify no regression
c. Commit: security(fix-N): <short description>
d. Advance to next finding
Stop early if guard fails — report the failure instead of proceeding
Uses ak:autoresearch guard pattern for regression prevention
Tip: Use --iterations N to cap total fix iterations when scope is large.
Severity Definitions
Severity
Description
Fix Priority
Critical
Exploitable now, data breach or RCE risk
Immediate — block release
High
Exploitable with moderate effort, significant impact
This sprint
Medium
Limited exploitability or impact
Next sprint
Low
Theoretical risk, defense-in-depth improvement
Backlog
Info
Best practice suggestion, no direct risk
Optional
Integration with Other Skills
Run after ak:predict when the security persona flags concerns
Feed Critical/High findings into ak:autoresearch --fix for automated remediation
Use ak:scenario with --focus authorization for deeper auth flow testing
Pair with ak:plan to schedule Medium/Low findings as sprint tasks
Example Invocations
# One-shot audit — API layer only
/ak:security src/api/**/*.ts
# Red-team discovery — full codebase, all 4 personas
/ak:security full --red-team
# Red-team discovery — bounded to 20 iterations total
/ak:security src/ --red-team --iterations 20
# Red-team discovery + auto-fix confirmed Critical/High
/ak:security full --red-team --fix
# One-shot audit + auto-fix, max 15 iterations
/ak:security src/ --fix --iterations 15
See references/stride-owasp-checklist.md for the detailed per-category checklist and secret detection regex patterns.
See references/red-team-personas.md for the full persona catalog: threat models, attack vectors, probe checklists, discovery loop integration, and TSV schema extension for --red-team mode.
Lineage
Faithful absorption (in scope) of upstream /autoresearch:security (uditgoenka/autoresearch, MIT). The local version supports both one-shot STRIDE + OWASP audit and the red-team-personas iterative discovery loop (closed in #730).
