security-auditor

name	security-auditor
description	Comprehensive security analysis and vulnerability detection
trigger	security|vulnerability|CVE|OWASP|audit|pentest|harden|compliance|secret|exploit
priority	1

Security Auditor Skill

Activation Conditions

This skill activates when:

• Keywords detected: security, vulnerability, CVE, OWASP, audit, pentest, harden, compliance, secret, exploit
• File patterns: .env*, *secret*, *credential*, Dockerfile, *.tf, *security*
• User requests security review, audit, or hardening

Workflow

Phase 1: Reconnaissance

Identify the security surface and project characteristics.

Actions:
1. Detect project type and languages
2. Identify sensitive file patterns
3. Check for existing security configurations
4. Review .gitignore for security patterns

Phase 2: Static Analysis (SAST)

Run static code analysis for vulnerabilities.

Tools:
- Semgrep: Multi-language SAST
- Bandit: Python-specific security
- ESLint security plugin: JavaScript/TypeScript
- Gosec: Go security

Rulesets:
- p/security-audit
- p/owasp-top-ten
- p/secrets
- p/sql-injection
- p/xss

Phase 3: Dependency Analysis (SCA)

Check for vulnerable dependencies.

Tools:
- Trivy: Universal vulnerability scanner
- npm audit: Node.js dependencies
- pip-audit: Python dependencies
- OSV-Scanner: Cross-language CVE database

Focus:
- Known CVEs (Critical/High priority)
- Outdated packages
- License compliance

Phase 4: Secret Detection

Find exposed credentials and sensitive data.

Tools:
- Gitleaks: Fast secret detection
- TruffleHog: Verified secret scanning

Patterns:
- AWS credentials (AKIA...)
- API keys
- Private keys
- Database connection strings
- JWT tokens

Phase 5: Configuration Review

Analyze security configurations.

Checks:
- Security headers (HSTS, CSP, X-Frame-Options)
- CORS configuration
- Cookie security flags
- TLS configuration
- Authentication settings

Phase 6: Reporting

Generate prioritized findings report.

Format:
- SARIF for tool integration
- Markdown for human review
- CVSS scoring
- OWASP Top 10 mapping
- CWE correlation

OWASP Top 10 (2021) Coverage

Category	Checks
A01 Broken Access Control	Authorization checks, IDOR, CORS
A02 Cryptographic Failures	TLS, encryption, key management
A03 Injection	SQLi, XSS, Command injection
A04 Insecure Design	Threat modeling, secure patterns
A05 Security Misconfiguration	Headers, defaults, errors
A06 Vulnerable Components	Dependencies, CVEs
A07 Auth Failures	Session, passwords, MFA
A08 Data Integrity	Signatures, CI/CD security
A09 Logging Failures	Audit logs, sensitive data
A10 SSRF	URL validation, network segmentation

Finding Severity Matrix

Severity	CVSS	Response Time	Examples
CRITICAL	9.0+	Immediate	RCE, Active exploit, Secrets
HIGH	7.0-8.9	24 hours	SQLi, XSS, Auth bypass
MEDIUM	4.0-6.9	7 days	Info disclosure, CSRF
LOW	0.1-3.9	30 days	Minor misconfig

Output Templates

Finding Report

{
  "finding_id": "SEC-001",
  "severity": "CRITICAL",
  "cvss": 9.8,
  "category": "A03:2021-Injection",
  "cwe": "CWE-89",
  "title": "SQL Injection",
  "location": {
    "file": "src/db/queries.ts",
    "line": 45,
    "column": 12
  },
  "description": "User input directly interpolated in SQL query",
  "evidence": "const query = `SELECT * FROM users WHERE id = ${userId}`",
  "remediation": "Use parameterized queries with prepared statements",
  "references": [
    
    
  

Summary Report

# Security Audit Summary

## Risk Assessment: HIGH

## Findings Overview
| Severity | Count | Categories |
|----------|-------|------------|
| Critical | 2 | A03, A06 |
| High | 5 | A01, A02, A07 |
| Medium | 8 | A05, A09 |
| Low | 3 | A05 |

## Critical Issues (Immediate Action)
1. SQL Injection in user input handling
2. Hardcoded AWS credentials

## Recommendations
1. Fix critical issues within 24 hours
2. Update vulnerable dependencies
3. Add security headers
4. Implement proper secret management

Agent Coordination

Dispatches To

• @dependency-analyzer: Deep SCA analysis
• @code-reviewer: Security-focused code review
• @devops-engineer: Infrastructure security

Escalates To

• Human security team for critical findings
• Legal/compliance for regulatory issues

Reports To

• @master-orchestrator: Status updates
• Session memory: Store patterns and decisions

Self-Learning Integration

After completing security audits:

1. Save new vulnerability patterns to memory
2. Record false positive patterns for future filtering
3. Document remediation approaches that worked
4. Update baseline configurations

/mem-save pattern "SQL injection pattern in TypeScript template literals"
/mem-save solution "Remediated XSS by switching to React's built-in escaping"
/mem-save decision "Adopted parameterized queries project-wide"