メニュー
Run security audit — dependency vulnerabilities, secret scanning, OWASP pattern detection, HTTP headers. Use when user wants to harden their project.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Build a regression + eval harness for AI-written code and AI features. Generates characterization tests that lock current behavior before a refactor, scaffolds a Promptfoo eval suite for chatbots/RAG/classifiers, and wires it into the ship-gate. Use when the user wants evals, regression tests for AI code, to stop AI features drifting, or to test an LLM feature.
Accessibility audit + auto-fix (WCAG 2.2 A/AA). Scans built/static HTML for screen-reader, keyboard, and structure failures, fixes the deterministic ones, and escalates to a rendered scan for contrast and focus. Use when the user wants to check or improve accessibility, fix WCAG issues, or pass an a11y review.
Turn the /ship scorecard into a blocking, config-as-code quality gate. Sets per-category score thresholds, hard-fails on leaked secrets or critical findings, and wires the gate into a pre-push hook and CI so nothing below the bar merges. Use when the user wants a merge gate, CI quality gate, pre-push check, or to enforce ship-readiness.
Post-deploy canary monitoring — checks site health, detects regressions, monitors for errors after deployment. Use after deploying to verify production is healthy.
Code review with principal-engineer-level depth. Reviews for correctness, performance, security, maintainability, and architecture. Use when completing tasks, reviewing PRs, or before merging.
Pre-flight checks then deploy. Validates env vars, migrations, bundle size, runs /ship audit, then deploys via git push or platform CLI.
| name | security-audit |
| description | Run security audit — dependency vulnerabilities, secret scanning, OWASP pattern detection, HTTP headers. Use when user wants to harden their project. |
| allowed-tools | Bash, Read, Grep, Glob |
| paths | ["**/package.json","**/package-lock.json","**/.env*","**/Gemfile.lock","**/requirements.txt"] |
Comprehensive security scan. Finds issues AND fixes them.
Detect package manager from lockfile and run audit:
pnpm-lock.yaml → pnpm auditpackage-lock.json → npm audityarn.lock → yarn auditIf critical/high vulnerabilities found, run the appropriate fix command (non-breaking only):
pnpm audit --fix # or npm audit fix
node ${CLAUDE_PLUGIN_ROOT}/tools/secret-scanner.mjs <project-directory>
For any findings:
Generic secret scanning misses the context mistakes that leak whole databases (the Moltbook breach class). Run the Sentinel:
node ${CLAUDE_PLUGIN_ROOT}/tools/vibe-security-scanner.mjs <project-directory>
It flags only categorical mistakes / decoded proof (zero false positives):
public-prefixed-secret-name / public-prefixed-secret-value — a server-only secret behind NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_/etc. Fix: rename without the public prefix, read it server-side only, and rotate the key (it was in the browser bundle).public-supabase-service-role-key — a decoded Supabase service_role JWT exposed to the client. Fix: rotate immediately; use the anon key on the client, service_role only on the server.service-role-in-client — a service_role key referenced in a "use client" component. Fix: move that Supabase call to a server action / route handler.supabase-table-without-rls — a table created with no Row Level Security. Fix: alter table <t> enable row level security; plus create policy rules. With the anon key public, an RLS-less table is world-readable/writable.mutation-routes-no-auth-lib (advisory) — confirm each POST/PUT/DELETE checks identity and is rate-limited.Use Grep to scan source files for dangerous patterns:
eval( → Suggest safer alternatives
new Function( → Suggest safer alternatives
.innerHTML = → Suggest textContent or sanitized HTML
dangerouslySetInnerHTML → Verify sanitization
SQL + variable → Suggest parameterized queries
http:// → Suggest https:// (mixed content)
Scan the codebase for auth-related weaknesses. These are the most exploited vulnerability class in web applications — a single flaw here typically means full account takeover.
Access-Control-Allow-Origin: * or origin: '*' or cors({ origin: true }). An allow-all CORS policy lets any malicious site make authenticated requests on behalf of your users. The fix is an explicit allowlist of trusted origins, never a wildcard when credentials are involved.express-rate-limit, Hono rateLimiter, Redis-backed sliding window), these endpoints are vulnerable to credential stuffing and brute force. Recommend per-IP and per-account limits (e.g., 5 attempts per minute per IP on login, 3 password resets per hour per email).jwt.sign and check for missing expiresIn option — a token without expiry is a permanent credential. Check for HS256 with secrets shorter than 256 bits (32 bytes); attackers can brute-force short HS256 secrets offline. Recommend RS256/ES256 for production, or HS256 with a cryptographically random secret of at least 32 bytes. Also check that jwt.verify does not pass algorithms: ['none'] or accept unsigned tokens.SameSite=Strict or SameSite=Lax cookie attribute, and no custom header requirement (e.g., X-Requested-With), these endpoints are exploitable via cross-site request forgery. SPAs using Authorization: Bearer headers are inherently CSRF-safe, but cookie-based auth requires explicit protection./api/users/:id, /api/orders/:id, /api/invoices/:id where the ID comes from the URL or request body. If the handler does not verify that the authenticated user owns or has permission to access that resource (e.g., WHERE id = :id AND userId = :currentUser), any authenticated user can access any other user's data by changing the ID. This is consistently in the OWASP Top 10 as "Broken Access Control."Scan for injection vectors beyond basic SQL concatenation. Injection flaws remain the most dangerous vulnerability class because they allow attackers to execute arbitrary operations within your application's context.
\SELECT * FROM users WHERE id = ${id}`), string building with + operators near SQL keywords, and ORM raw query methods (knex.raw(), prisma.$queryRawUnsafe(), sequelize.query()` without bind parameters). Even ORMs are vulnerable when developers use raw query escape hatches.fs.readFile, fs.readFileSync, fs.createReadStream, path.join, path.resolve, or res.sendFile. If the input is not validated against ../ sequences (or null bytes on older Node versions), attackers can read arbitrary files from the server — /etc/passwd, .env, private keys. The fix is to resolve the path and verify it starts with the intended base directory.child_process.exec, child_process.execSync, shell: true in spawn options, or any function that passes user input to a shell. An attacker who controls even part of a shell command can chain arbitrary commands with ;, &&, |, or backticks. The fix is execFile/execFileSync (no shell) with arguments as an array, never string interpolation.fetch, axios, http.get, or any HTTP client. Without validation, an attacker can make your server request internal services (http://169.254.169.254 for cloud metadata, http://localhost:6379 for Redis, internal microservices). Validate that URLs resolve to public IP addresses and use an allowlist of permitted schemes and hosts.xml2js, libxmljs, fast-xml-parser, DOMParser), check that external entity processing is disabled. XXE allows attackers to read local files, perform SSRF, or cause denial of service via billion-laughs expansion. Most modern parsers disable XXE by default, but verify the configuration explicitly.Object.assign({}, userInput), _.merge({}, userInput), _.defaultsDeep, JSON.parse results used in deep merge operations, and __proto__ or constructor.prototype in request bodies. Prototype pollution lets attackers inject properties into Object.prototype, which can escalate to RCE in some frameworks (e.g., via EJS template engine gadgets). The fix is Object.create(null) for dictionary objects, input schema validation, and Object.freeze(Object.prototype) in hardened environments.Modern applications pull in hundreds of transitive dependencies. A single compromised package in the dependency tree can execute arbitrary code on every developer machine and CI server.
npm pkg get scripts.postinstall or grep lockfile for "postinstall" hooks in dependencies. Malicious packages use postinstall scripts to exfiltrate environment variables, SSH keys, or install backdoors. Legitimate packages that need postinstall (e.g., esbuild, sharp for native binaries) should be audited individually.lodas vs lodash), scope confusion (@internal/utils vs internal-utils), and hyphen/underscore variants. Typosquatted packages typically mirror the real package's API while adding a backdoor.package.json. A missing or manipulated lockfile means builds are not reproducible and dependency resolution could pull in malicious versions. Run pnpm install --frozen-lockfile (or npm ci) in CI to enforce lockfile integrity.npm config set ignore-scripts true in CI environments, then explicitly allowlist packages that need install scripts. This prevents supply chain attacks via postinstall hooks from newly added or compromised dependencies.If a dev server is running, use curl or fetch to check response headers:
If missing, generate middleware snippet for the project's framework:
app.use('*', secureHeaders())node ${CLAUDE_PLUGIN_ROOT}/tools/dep-doctor.mjs <project-directory>
Report:
Weak or misused cryptography is often invisible until a breach. These checks catch the most common mistakes that silently undermine the security of authentication, token generation, and data protection.
createHash('md5'), createHash('sha1'), or any use of MD5/SHA1 for security purposes (password hashing, token generation, integrity verification). MD5 has practical collision attacks; SHA1 is deprecated by NIST since 2011. These are acceptable only for non-security checksums (e.g., cache keys, ETags). For integrity, use SHA-256 or SHA-3. For passwords, use bcrypt or argon2 exclusively.createCipheriv, createDecipheriv, and check whether the key or IV is a string literal, hex constant, or imported from a non-env source. Hardcoded keys mean every deployment shares the same key, and anyone with source code access (including leaked repos) can decrypt all data. Keys must come from environment variables or a secrets manager, and IVs must be randomly generated per encryption operation.Math.random() used anywhere near token generation, session IDs, OTP codes, password reset links, or API keys. Math.random() is not cryptographically secure — its output is predictable given enough samples. The fix is crypto.randomBytes() or crypto.randomUUID() for Node.js, or crypto.getRandomValues() for browser contexts.createHash used on passwords — this means passwords are hashed with a fast algorithm (SHA-256, MD5) without salting or key stretching, making them trivially crackable with rainbow tables or GPU brute force. Also check bcrypt cost factors below 10, which are insufficient for modern hardware.Data leakage is the silent breach — it does not trip alarms, does not require exploits, and often goes unnoticed until the data appears on a paste site. These checks catch the most common ways applications hemorrhage sensitive information.
NODE_ENV conditional logic. If err.stack, err.message, or raw error objects are sent in HTTP responses without checking the environment, attackers get free reconnaissance — internal file paths, framework versions, database connection strings, and query structures. The fix is a generic error response in production with a correlation ID for internal log lookup.console.log, logger.info, logger.debug, and logging library calls that include request bodies, user objects, or variables named email, phone, password, ssn, token, secret, creditCard, or ip. Logs are often stored in plain text, shipped to third-party log aggregators, and retained long past their usefulness. Recommend structured logging with explicit field allowlists and automatic PII redaction.res.json(user) where user is a Drizzle/Prisma/Sequelize model), it likely leaks internal fields: passwordHash, resetToken, internalNotes, stripeCustomerId, createdAt metadata, or soft-delete flags. The fix is explicit response DTOs or select/pick at the query level — never return the raw model.unsafe-inline, unsafe-eval, and wildcard sources (*) in existing CSPs. A baseline CSP should at minimum set default-src 'self', script-src 'self', and object-src 'none'. Report-only mode (Content-Security-Policy-Report-Only) is a safe way to deploy CSP incrementally without breaking existing functionality.Think like an attacker. For every endpoint, ask: "What happens if I send unexpected input?" For every data flow, ask: "What if this is intercepted?" For every dependency, ask: "What if this is compromised?" Fix what you find. Document what you can't fix. Treat security as a spectrum, not a checkbox.