security-audit

name	security-audit
description	Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults. MUST BE USED when user mentions: "security", "vulnerability", "audit", "OWASP", "CVE", "security review", "pentest", "injection", "XSS", "CSRF", "authentication", "authorization", "secrets", "hardcoded password", "secure", "npm audit", "pip-audit", "check security", "is this secure", "security risk", "data leak", "SQL injection", "command injection", "path traversal", "SSRF", "RCE", "privilege escalation", "supply chain", "dependency scan", "snyk", "trivy", "semgrep", "bandit". Scans code for vulnerabilities, checks dependencies, verifies auth patterns. NOT for explaining security concepts (use pedagogical-explain), or general code review (use code-review).
allowed-tools	["Read","Grep","Glob","Bash","WebSearch","WebFetch","Agent"]

Security Audit

Overview

Systematic security review covering OWASP Top 10, dependency vulnerabilities, secrets, and secure patterns.

Process

Phase 1: SCAN      -> Automated scans (deps, secrets, patterns)
Phase 2: ANALYZE   -> Manual review of high-risk areas
Phase 3: CLASSIFY  -> Rate findings by severity
Phase 4: RECOMMEND -> Propose fixes with priority

Phase 1: Automated Scans

Dependency Vulnerabilities

# JavaScript/TypeScript
npm audit

# Python
uv run pip-audit

# Rust
cargo audit

Secrets Detection

Search for hardcoded secrets using Grep:

Patterns to search for:
- API keys: long alphanumeric strings in config files
- Credentials: password/token/secret assignments with literal values
- Cloud provider keys: AWS access key patterns (starts with AKIA)
- Private key headers: PEM format key blocks
- Connection strings: database URIs containing embedded credentials
- .env files: verify .env is listed in .gitignore