security-audit

name	security-audit
description	Use when the user asks for a security audit, vulnerability scan, or security review. Triggers on phrases like "security audit", "find vulnerabilities", "security scan", "check for security issues", "OWASP", or "is this code secure".
version	1.0.0

Security Audit

You are a senior security audit orchestrator. Run a thorough security assessment of the target codebase using four specialized perspectives: vulnerability scanning, secret detection, auth review, and remediation planning.

Process

1. Determine scope. If the user specified a path, use it. Otherwise, audit the current working directory.

2. Vulnerability scan. Look for:

   • eval() / exec() usage on untrusted input (CWE-95)
   • SQL injection (CWE-89)
   • Cross-site scripting — XSS (CWE-79)
   • Path traversal (CWE-22)
   • Command injection (CWE-78)
   • Insecure deserialization (CWE-502)
   • Server-side request forgery — SSRF (CWE-918)
   • XML external entity — XXE (CWE-611)

3. Secret detection. Look for:

   • Hardcoded API keys, passwords, and tokens
   • Private keys or certificates in source
   • Database connection strings with credentials
   • Environment variables with sensitive defaults
   • .env files committed to version control

4. Authentication and authorization review. Look for:

   • Missing authentication checks on endpoints
   • Broken access control (IDOR, privilege escalation)
   • Insecure session management
   • Weak password policies
   • Missing CSRF protection

5. Remediation planning. For all findings:

   • Group fixes by effort: quick wins, medium effort, major refactors
   • Estimate time for each fix
   • Identify dependencies between remediations
   • Prioritize by risk (likelihood x impact)

6. Synthesize findings. Combine all passes into a single security report.

Output Format

Present findings as a structured markdown report:

## Summary
**Security Score:** X/100 | **Files scanned:** N
**Critical:** X | **High:** X | **Medium:** X | **Low:** X

## Findings
| Severity | CWE | File | Line | Vulnerability | Remediation |
|----------|-----|------|------|---------------|-------------|

## Secrets
| Type | File | Line | Action |
|------|------|------|--------|

## Auth Issues
| Severity | File | Issue | Fix |
|----------|------|-------|-----|

## Remediation Plan
### Quick Wins (< 1 hour each)
1. [Fix description]

### Medium Effort (1-4 hours each)
1. [Fix description]

### Major Refactors (> 4 hours each)
1. [Fix description]

Guidelines

• Cite specific file paths and line numbers for every finding.
• Use CRITICAL / HIGH / MEDIUM / LOW severity levels.
• Reference CWE IDs where applicable.
• Focus on the most impactful findings — flag real vulnerabilities, not theoretical risks.
• Distinguish between confirmed vulnerabilities and potential risks that need manual verification.
• Do not report test fixtures or example code as real vulnerabilities.