security-audit

name	security-audit
description	Commands, step-by-step procedures, and mechanical execution for performing deep security audits, vulnerability assessments, and report generation on codebases and configurations. You MUST load this skill when performing security audits or validation.
license	MIT

Security Auditing Skill

This skill outlines the mechanical steps, mindset, and procedures required to conduct a thorough security audit on a target codebase or architectural component. It integrates dependency analysis, deep vulnerability scanning, structured threat modeling, and strict output constraints.

WHEN TO USE

Use this skill when the request involves:

• Scanning a codebase or file for security vulnerabilities
• Running a security audit or vulnerability check
• Checking for SQL injection, XSS, command injection, or other injection flaws
• Finding exposed API keys, hardcoded secrets, or credentials in code
• Auditing dependencies for known CVEs
• Reviewing authentication, authorization, or access control logic
• Detecting insecure cryptography or weak randomness
• Performing a data flow analysis to trace user input to dangerous sinks
• Any request phrasing like "is my code secure?", "scan this file", or "check my repo for vulnerabilities"
• Running /security-audit or /security-audit <path>

WHEN NOT TO USE

• When performing a lightweight PR review (use security-review).
• When writing tests for functional validation (use testing or tdd).
• When optimizing code purely for performance without a security context.

Common Pitfalls

• False Positives: Flagging code as vulnerable purely based on regex matches without considering existing sanitization or trust boundaries.
• Ignoring the Supply Chain: Auditing the source code meticulously but neglecting to check package.json or requirements.txt for known CVEs.
• Suggesting Breaking Changes: Recommending heavy-handed security controls that completely break the application's core business logic.

Role Persona & Cognitive Framework

• Adversarial Attacker Engine: Think like an advanced persistent threat (APT). Ask "How can I bypass this check?", "What happens if this input is 10GB?", and "Can I pivot from this resource to another?"
• Zero-Trust Assumption Principle: Assume developers have made the most common mistake and that the network is already compromised.
• Root Cause Vulnerability Tracing: Trace security flaws to their architectural root.
• Audit-Only Enforcement: Base your analysis on reading the code, static analysis, and configuration inspection.
• Exploit & Remediation Pairing: For every vulnerability found, provide both the adversarial attack scenario and an exact, implementable remediation.

1. Threat Surface Discovery & Triage

1. Architecture & Trust Boundary Mapping:
   • Identify all primary assets, actors, data flows, and entry points.
   • Map explicit trust boundaries.
2. Dependency & Supply Chain Audit:
   • Analyze dependency manifests to identify vulnerable dependencies (known CVEs).

2. Deep Vulnerability Audit Execution

Execute a rigorous, ordered security analysis against the target architecture:

1. Injection & Input Handling: SQLi, XSS, command injection.
2. Authentication & Authorization: RBAC, IDOR, session management.
3. Secrets, Cryptography & Data Protection: Credential scanning, weak crypto.
4. Security Headers & Network Config: CSP, HSTS, CORS.
5. Third-Party Integrations: Webhooks, API keys.
6. AI & Prompt Security: Prompt injection boundaries.

3. Threat Modeling & Exploitability Assessment

1. STRIDE Analysis.
2. Attack Scenario Formulation.
3. Blast-Radius Check.
4. Risk Ranking.

4. Remediation Reporting

Output the full report in the structured format defined in references/report-format.md.

Output Format

The report MUST include:

1. Findings Summary Table.
2. Detailed Findings.
3. Dependency Audit.
4. Secrets Scan.
5. Patch Proposals.

Execution Workflow

Step 1 — Scope Resolution

Step 2 — Dependency Audit

Step 3 — Secrets & Exposure Scan

Step 4 — Vulnerability Deep Scan

Step 5 — Cross-File Data Flow Analysis

Step 6 — Self-Verification Pass

Step 7 — Generate Security Report

Step 8 — Propose Patches

Severity Guide

Severity	Meaning
🔴 CRITICAL	Immediate exploitation risk, data breach likely
🟠 HIGH	Serious vulnerability, exploit path exists
🟡 MEDIUM	Exploitable with conditions or chaining
🔵 LOW	Best practice violation, low direct risk
⚪ INFO	Observation worth noting

Reference Files

• references/vuln-categories.md
• references/secret-patterns.md
• references/language-patterns.md
• references/vulnerable-packages.md
• references/report-format.md

Related Skills

• critical-thinking
• robust-commands
• security-review