forge-security-audit

name	forge-security-audit
description	Security review of source code - detect vulnerabilities (SQL injection, XSS, CSRF, SSRF, RCE), secrets, config issues. Trigger when user types /forge-security-audit or requests a security audit/review.

/forge-security-audit

Security review of source code using AI reasoning.

Command

/forge-security-audit [path] [--quick|--deep] [--markdown|--json] [--verbose]

Options

• [path] — Target directory (default: current directory)
• --quick — Fast scan, focus on critical issues only
• --deep — Thorough scan, check all patterns
• --markdown — Output as markdown (default)
• --json — Output as JSON
• --verbose — Include detailed evidence

Purpose

Analyze source code for:

• Security vulnerabilities (SQL Injection, XSS, CSRF, SSRF, RCE)
• Hardcoded secrets (API keys, tokens, passwords)
• Configuration issues (CORS, debug mode, JWT)
• Infrastructure security (Dockerfile, K8s, CI/CD)

Workflow

Step 1: Understand Project

Use shared/analyzer/ to detect:

• Repository type
• Primary language
• Framework
• Project structure

Step 2: Run Security Analysis

Execute analysis prompts in order:

1. Secrets Detection (prompts/secrets-detection.md)
2. Source Code Review (prompts/source-code-review.md)
3. Configuration Review (prompts/config-review.md)
4. Infrastructure Review (prompts/infrastructure-review.md)

Step 3: Classify Findings

For each finding:

• Assign severity: Critical, High, Medium, Low, Info
• Assign confidence: High, Medium, Low
• Include evidence (file, line, code snippet)

Step 4: Generate Report

Use shared/report/ to generate:

• Security Score (0-100)
• Severity-grouped findings
• Recommendations
• Next steps

Output Format

Follow the markdown report format generated by shared/report/markdown.ts. It MUST use the following layout:

Security Audit Report

Project: [Project Name]
Path: [Project Path]
Language: [Primary Language]
Framework: [Detected Framework (optional)]
Date: [Timestamp]

Score

[Score]/100 (Grade: [Grade])

Severity	Count
🔴 Critical	[count]
🟠 High	[count]
🟡 Medium	[count]
🔵 Low	[count]
⚪ Info	[count]

Executive Summary

Found [total] issues: [count] critical, [count] high, [count] medium, [count] low, [count] info.

🔍 Detailed Findings

[Severity Group (e.g. 🔴 Critical)]

Title	Location	Description	Impact
[Finding Title]	[file-name]:[line]	[Description]	[Impact]

📂 Code Evidence

Finding #[number]: [Finding Title]

[code snippet]

Integration with Shared Components

import { analyzeRepository, detectFrameworks } from "../../shared/analyzer";
import { createFinding, classifyFinding } from "../../shared/findings";
import { calculateScore, generateMarkdownReport } from "../../shared/report";

Confidence Levels

• High: Pattern match with clear evidence
• Medium: Likely issue, needs verification
• Low: Possible issue, context-dependent