| name | forge-security-audit |
| description | Security review of source code - detect vulnerabilities (SQL injection, XSS, CSRF, SSRF, RCE), secrets, config issues. Trigger when user types /forge-security-audit or requests a security audit/review.
|
/forge-security-audit
Security review of source code using AI reasoning.
Command
/forge-security-audit [path] [--quick|--deep] [--markdown|--json] [--verbose]
Options
[path] — Target directory (default: current directory)--quick — Fast scan, focus on critical issues only--deep — Thorough scan, check all patterns--markdown — Output as markdown (default)--json — Output as JSON--verbose — Include detailed evidence
Purpose
Analyze source code for:
- Security vulnerabilities (SQL Injection, XSS, CSRF, SSRF, RCE)
- Hardcoded secrets (API keys, tokens, passwords)
- Configuration issues (CORS, debug mode, JWT)
- Infrastructure security (Dockerfile, K8s, CI/CD)
Workflow
Step 1: Understand Project
Use shared/analyzer/ to detect:
- Repository type
- Primary language
- Framework
- Project structure
Step 2: Run Security Analysis
Execute analysis prompts in order:
- Secrets Detection (
prompts/secrets-detection.md)
- Source Code Review (
prompts/source-code-review.md)
- Configuration Review (
prompts/config-review.md)
- Infrastructure Review (
prompts/infrastructure-review.md)
Step 3: Classify Findings
For each finding:
- Assign severity: Critical, High, Medium, Low, Info
- Assign confidence: High, Medium, Low
- Include evidence (file, line, code snippet)
Step 4: Generate Report
Use shared/report/ to generate:
- Security Score (0-100)
- Severity-grouped findings
- Recommendations
- Next steps
Output Format
Follow the markdown report format generated by shared/report/markdown.ts. It MUST use the following layout:
Security Audit Report
Project: [Project Name]
Path: [Project Path]
Language: [Primary Language]
Framework: [Detected Framework (optional)]
Date: [Timestamp]
Score
[Score]/100 (Grade: [Grade])
| Severity | Count |
|---|
| 🔴 Critical | [count] |
| 🟠 High | [count] |
| 🟡 Medium | [count] |
| 🔵 Low | [count] |
| ⚪ Info | [count] |
Executive Summary
Found [total] issues: [count] critical, [count] high, [count] medium, [count] low, [count] info.
🔍 Detailed Findings
[Severity Group (e.g. 🔴 Critical)]
| Title | Location | Description | Impact |
|---|
| [Finding Title] | [file-name]:[line] | [Description] | [Impact] |
📂 Code Evidence
Finding #[number]: [Finding Title]
[code snippet]
Integration with Shared Components
import { analyzeRepository, detectFrameworks } from "../../shared/analyzer";
import { createFinding, classifyFinding } from "../../shared/findings";
import { calculateScore, generateMarkdownReport } from "../../shared/report";
Confidence Levels
- High: Pattern match with clear evidence
- Medium: Likely issue, needs verification
- Low: Possible issue, context-dependent
