security-audit

name	security-audit
description	Scan code for security vulnerabilities — OWASP Top 10, credential leaks, injection attacks, path traversal, and insecure configurations. Trigger on /security-audit, or when reviewing code for security issues.
user-invocable	true
allowed-tools	Read, Grep, Glob, Bash

Security Audit

Review code for security vulnerabilities. Read-only — do not fix without explicit approval.

Audit Checklist

1. Injection attacks

• Command injection — user input passed to shell commands (exec, spawn, eval, $())?
• SQL injection — raw query construction instead of parameterized queries?
• Path traversal — user input used in file paths without sanitization?
• XSS — user input rendered in HTML without escaping?

2. Secrets and credentials

• Hardcoded API keys, tokens, passwords, or connection strings?
• .env files committed to git?
• Secrets in logs, error messages, or test output?
• AWS/cloud credentials in code?

3. Authentication and authorization

• Missing auth checks on protected endpoints?
• Weak password policies or storage?
• Session management issues (fixed tokens, no expiry)?
• Insecure direct object references (IDOR)?

4. Data validation

• Missing input validation on user-supplied data?
• Insufficient output encoding?
• Unsafe deserialization?
• Trusting client-side data (price, role, permissions)?

5. Configuration

• Debug/development mode enabled in production?
• Exposed internal endpoints?
• Insecure CORS configuration?
• Missing security headers?

6. Dependencies

• Known vulnerable packages?
• Outdated dependencies with known CVEs?
• Unnecessary dependencies increasing attack surface?

Reporting

Order by severity: critical → high → medium → low.

## Findings

### Critical
- ...

### High
- ...

### Medium
- ...

### Low / Info
- ...

Rules

• Read-only — do not fix vulnerabilities unless explicitly asked.
• Do not run security tools that modify files or configurations.
• Report findings with specific file:line references.
• If unsure about a finding, flag it as "needs verification."
• Never disclose findings outside the project.

Experience Log

This skill learns from experience. Mechanism:

• Read .claude/experience/security-audit.md at skill start to benefit from past lessons.
• Write to .claude/experience/security-audit.md after use if you learned something new.
• Format: YYYY-MM-DD: <lesson> — one line per entry.
• Evolve: If the same issue repeats 3+ times, update this SKILL.md itself.