security-audit-pro

name	security-audit-pro
description	Security audit with SAST, SCA, containers, SBOM, PII detection. Use for comprehensive security reviews.
context	fork
globs	["**/*.py","**/*.ts","**/*.tsx","**/*.js","**/*.yml","**/*.yaml","**/Dockerfile*","**/docker-compose*"]
alwaysApply	false

Security Audit Pro — Comprehensive Security Review

Use this skill for professional-grade security auditing. Covers SAST, SCA, container security, SBOM, PII detection, and compliance patterns. Used by Themis during code review.

---

Scope

This skill replaces and expands the basic security-audit skill. It covers:

Domain	Coverage
SAST	SQL injection, XSS, CSRF, path traversal, command injection
SCA	Dependencies with known CVEs, outdated packages
Container	Non-root user, health checks, secrets, minimal base images
SBOM	Software Bill of Materials generation
PII	Detection of personal data in code/logs
Compliance	GDPR, LGPD, HIPAA patterns

---

SAST — Static Application Security Testing

SQL Injection

❌ Vulnerable:

query = f"SELECT * FROM users WHERE email = '{email}'"
await db.execute(query)

✅ Safe:

query = text("SELECT * FROM users WHERE email = :email")
await db.execute(query, {"email": email})

XSS (Cross-Site Scripting)

❌ Vulnerable:

return HTMLResponse(content=f"<h1>Welcome, {user.name}</h1>")

✅ Safe:

from markupsafe import escape
return HTMLResponse(content=f"<h1>Welcome, {escape(user.name)}</h1>")

CSRF

Check:

• CSRF tokens on state-changing endpoints
• SameSite cookie attribute set
• Origin/Referer header validation

Path Traversal

❌ Vulnerable:

file_path = f"/uploads/{filename}"
return FileResponse(file_path)

✅ Safe:

import os
base_dir = "/uploads"
file_path = os.path.join(base_dir, os.path.basename(filename))
if not file_path.startswith(base_dir):
    raise HTTPException(400, "Invalid path")
return FileResponse(file_path)

Command Injection

❌ Vulnerable:

os.system(f"convert {input_file} {output_file}")

✅ Safe:

import subprocess
subprocess.run(["convert", input_file, output_file], check=True)

---

SCA — Software Composition Analysis

Dependency Audit

Run these commands to check for vulnerabilities:

# Python
pip-audit -r requirements.txt
safety check -r requirements.txt

# Node.js
npm audit
npx audit-ci --moderate

Common Vulnerable Patterns

Pattern	Risk	Fix
requests < 2.31.0	CVE-2023-32681	Upgrade to >= 2.31.0
pydantic < 2.0	Validation bypass	Upgrade to >= 2.7
sqlalchemy < 2.0	SQL injection risk	Upgrade to >= 2.0
express < 4.18.2	Open redirect	Upgrade to >= 4.18.2

---

Container Security

Dockerfile Checklist

• Non-root user (USER appuser)
• Health check defined (HEALTHCHECK)
• No hardcoded secrets (use env vars or vault)
• Minimal base image (python:3.12-slim not python:3.12)
• Multi-stage build (build deps not in final image)
• .dockerignore present
• No COPY . . (copy only needed files)

docker-compose Checklist

• No secrets in environment variables (use .env or vault)
• Resource limits defined (deploy.resources)
• Network isolation (separate networks for frontend/backend)
• Read-only filesystem where possible (read_only: true)
• No privileged: true

---

SBOM — Software Bill of Materials

Generate SBOM for compliance:

# Python
pip install cyclonedx-bom
cyclonedx-py -r requirements.txt -o sbom.json --format json

# Node.js
npm install --save-dev @cyclonedx/cyclonedx-npm
npx cyclonedx-npm --output-file sbom.json

---

PII Detection

Scan code and logs for personal data:

Pattern	Example	Severity
Email in logs	logger.info(f"User {email} logged in")	High
SSN/CPF in code	cpf = "123.456.789-00"	Critical
Phone numbers	phone = "[phone]"	High
Credit cards	card = "4111 1111 1111 1111"	Critical
Passwords in code	PASSWORD = "secret123"	Critical

PII Protection Patterns

# ❌ Logging PII
logger.info(f"User {user.email} with CPF {user.cpf} created account")

# ✅ Hashing PII in logs
import hashlib
logger.info(f"User {hashlib.sha256(user.email.encode()).hexdigest()[:8]} created account")

---

Compliance Patterns

GDPR (EU)

• Right to be forgotten implemented (delete user data endpoint)
• Data portability (export user data endpoint)
• Consent management (explicit opt-in, not opt-out)
• Data minimization (only collect what's needed)
• Privacy by design (privacy considered in architecture)

LGPD (Brazil)

• Same as GDPR + ANPD notification procedures
• Data Protection Officer (DPO) contact available
• Portuguese privacy policy

HIPAA (US Healthcare)

• Encryption at rest (database encryption)
• Encryption in transit (TLS 1.2+)
• Access logging (who accessed what, when)
• Audit trails (immutable logs)
• Business Associate Agreements (BAAs) with vendors

---

Integration with Themis

Themis applies this skill during code review:

Themis receives code for review
  ↓
Applies security-audit-pro skill
  ↓
Runs SAST checks (manual pattern matching)
  ↓
Runs SCA checks (pip-audit / npm audit)
  ↓
Checks container security (Dockerfile, docker-compose)
  ↓
Scans for PII patterns
  ↓
Checks compliance patterns
  ↓
Returns security review results