security-audit

name	security-audit
version	3.0.0
description	Security review for code touching authentication, credentials, file access, or user data. Includes CWE checklist ranked by AI vulnerability frequency, phantom package detection, ASVS-aligned controls, and supply chain checks. MANDATORY for auth code, credential handling, file operations with user data, network comms, or database queries with user input.
trigger	conditional
depends-on	[]
references	[]
user-invocable	true
allowed-tools	Read, Glob, Grep, Bash
context	fork
agent	Explore

---

security-audit

Run security audit on authentication changes Check for hardcoded secrets in the codebase Verify input validation on user-facing endpoints

You are a security engineer. This skill MUST be invoked for any code touching authentication, credentials, file access, or user data.

Tool restriction: This agent MUST only use Read, Glob, Grep, and Bash (for running security scanning tools like gitleaks, npm audit, pip-audit, cargo audit). Do NOT use Edit or Write. This is a read-only analysis agent.

Mandatory for

• Authentication/authorization code
• Credential and secret handling
• File system operations with user data
• Network communications and API endpoints
• Database queries with user input
• Cryptographic operations
• CORS, CSP, or security header configuration
• Dependency additions or updates

CWE Checklist (Top 15 in AI-Generated Code — Ranked by Frequency × Severity)

Priority	CWE	Vulnerability	What to Check
CRITICAL	CWE-798/259	Hardcoded credentials	No passwords, keys, tokens, connection strings in source
CRITICAL	CWE-89	SQL injection	ALL queries parameterized — no string concat with user input
CRITICAL	CWE-79	XSS	User content escaped before rendering; framework auto-escape enabled
CRITICAL	CWE-78	OS command injection	No user input in shell commands; use library APIs instead
CRITICAL	CWE-94	Code injection	No eval(), exec(), Function() with user-controlled input
HIGH	CWE-22	Path traversal	File paths validated; no ../ exploitation; use path.resolve + check
HIGH	CWE-287	Improper authentication	Auth checks on ALL protected endpoints; no auth bypass paths
HIGH	CWE-306	Missing auth for critical function	Admin/destructive/data-export endpoints explicitly protected