菜单
Security assessment workflow. Use when reviewing code for vulnerabilities, performing OWASP checks, auditing authentication/authorization logic, or validating security controls before deployment.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/ar4mirez/samuel --skill security-audit命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | security-audit |
| description | Security assessment workflow. Use when reviewing code for vulnerabilities, performing OWASP checks, auditing authentication/authorization logic, or validating security controls before deployment. |
| license | MIT |
| metadata | {"author":"samuel","version":"1.0","category":"workflow"} |
Proactive security assessment covering OWASP Top 10, dependency vulnerabilities, secrets detection, and security best practices.
| Trigger | Priority | Description |
|---|---|---|
| Pre-Production | Critical | Before any production deployment |
| Monthly Review | High | Regular security hygiene |
| Auth Changes | Critical | After adding/modifying authentication |
| External Integration | High | When adding third-party services |
| Dependency Updates | Medium | After major dependency changes |
| Security Incident | Critical | Post-incident review |
Complete security review across all categories. Time: 2-4 hours.
Target specific area (e.g., authentication only). Time: 30-60 minutes.
Automated checks only (dependencies, secrets). Time: 5-10 minutes.
Before starting audit:
Phase 1: OWASP Top 10 Review
↓
Phase 2: Dependency Vulnerability Scan
↓
Phase 3: Secrets Detection
↓
Phase 4: Input Validation Audit
↓
Phase 5: Authentication & Authorization
↓
Phase 6: API Security
↓
Phase 7: Report & Remediation
| ID | Category | Key Check |
|---|---|---|
| A01 | Broken Access Control | Authorization on all endpoints |
| A02 | Cryptographic Failures | TLS, password hashing, encryption |
| A03 | Injection | Parameterized queries, input escaping |
| A04 | Insecure Design | Defense in depth, trust boundaries |
| A05 | Security Misconfiguration | Headers, defaults, error messages |
| A06 | Vulnerable Components | Dependency scanning |
| A07 | Authentication Failures | Password policy, session security |
| A08 | Data Integrity | Checksums, secure CI/CD |
| A09 | Logging Failures | Security event logging |
| A10 | SSRF | URL validation, network restrictions |
For detailed patterns and examples: See references/process.md
A01 - Broken Access Control:
- [ ] All endpoints have authorization checks
- [ ] RBAC implemented
- [ ] No direct object reference vulnerabilities
- [ ] Privilege escalation prevented
A02 - Cryptographic Failures:
- [ ] Passwords hashed with bcrypt/argon2 (cost 10+)
- [ ] TLS 1.2+ enforced
- [ ] Sensitive data encrypted at rest
- [ ] Cryptographically random tokens
A03 - Injection:
- [ ] SQL queries use parameterized statements
- [ ] Template engines auto-escape output
- [ ] No shell command execution with user input
- [ ] NoSQL queries sanitized
A05 - Security Misconfiguration:
Required Headers:
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Content-Security-Policy: default-src 'self'
- Strict-Transport-Security: max-age=31536000
# Node.js
npm audit
npm audit --audit-level=moderate
# Python
pip-audit
# Or: safety check --json > audit-report.json
# Go
govulncheck ./...
# Rust
cargo audit
# Ruby
bundle audit check
| Severity | Action | Timeline |
|---|---|---|
| Critical | Immediate fix or remove | Hours |
| High | Fix in current sprint | Days |
| Moderate | Schedule fix | Weeks |
| Low | Track for update | Next release |
# Using gitleaks (recommended)
gitleaks detect --source . --verbose
# Using git-secrets
git secrets --scan
git secrets --scan-history
# Using truffleHog
trufflehog filesystem .
| Pattern | Example | Risk |
|---|---|---|
| API Keys | sk_live_, AKIA | High |
| Passwords | password=, passwd | Critical |
| Tokens | token=, bearer | High |
| Private Keys | -----BEGIN RSA | Critical |
| AWS Credentials | aws_access_key_id | Critical |
Checklist:
- [ ] All secrets in environment variables (not code)
- [ ] .env files in .gitignore
- [ ] No .env files in git history
- [ ] Secure defaults for all variables
| Source | Examples | Risk |
|---|---|---|
| File uploads | Images, documents | Critical |
| Request body | JSON, form data | High |
| URL parameters | /users/:id | High |
| Query strings | ?search=term | High |
| Headers | Custom headers | Medium |
| Cookies | Session cookies | Medium |
For each input:
- [ ] Magic bytes validation (not just extension)
- [ ] Size limits enforced
- [ ] Virus/malware scanning
- [ ] Storage outside web root
- [ ] Randomized filenames
- [ ] No executable permissions
- [ ] Min length: 12+ characters
- [ ] Bcrypt (cost 10+) or argon2
- [ ] No passwords in logs/errors
- [ ] Rate limiting on login
- [ ] Account lockout policy
- [ ] HttpOnly cookie flag
- [ ] Secure cookie flag (HTTPS)
- [ ] SameSite attribute
- [ ] Session timeout
- [ ] Invalidation on logout
- [ ] Regenerate on privilege change
- [ ] Check on every endpoint
- [ ] RBAC implemented
- [ ] Least privilege
- [ ] Deny by default
- [ ] Server-side validation
- [ ] Strong algorithm (RS256, ES256)
- [ ] Token expiration
- [ ] Refresh mechanism
- [ ] Revocation capability
- [ ] No sensitive data in payload
- [ ] Enabled on all endpoints
- [ ] Stricter on auth endpoints
- [ ] Per-user and per-IP
- [ ] Graduated response
// Secure configuration
{
origin: ['https://app.example.com'], // Not '*'
credentials: true,
methods: ['GET', 'POST', 'PUT', 'DELETE']
}
- [ ] Generic messages to clients
- [ ] Details in logs only
- [ ] No stack traces in production
- [ ] Consistent format
# Security Audit Report
**Date**: YYYY-MM-DD
**Auditor**: [Name]
**Scope**: [Full/Focused/Quick]
**Duration**: [Hours]
## Executive Summary
| Severity | Count | Status |
|----------|-------|--------|
| Critical | N | [Status] |
| High | N | [Status] |
| Medium | N | [Status] |
| Low | N | [Status] |
**Overall Risk**: [Low/Medium/High/Critical]
## Findings
### [Severity]: [Issue Title]
**Location**: [File:Line]
**Description**: [Brief description]
**Impact**: [Potential impact]
**Remediation**: [How to fix]
**Timeline**: [When to fix]
## Recommendations
1. [Recommendation 1]
2. [Recommendation 2]
## Tools Used
- [Tool 1]
- [Tool 2]
| Finding | Severity | Effort | Priority |
|---|---|---|---|
| SQL Injection | Critical | Low | Immediate |
| Missing Auth | High | Medium | Sprint 1 |
| Weak Hash | High | Low | Sprint 1 |
| Missing Headers | Medium | Low | Sprint 2 |
| Old Dependency | Low | Low | Backlog |
# Node.js
npm audit && npx gitleaks detect
# Python
pip-audit && gitleaks detect
# Go
govulncheck ./... && gitleaks detect
# Rust
cargo audit && gitleaks detect
Extended Content:
references/process.md - Detailed vulnerability patterns, code examples, language-specific guidanceRelated Workflows:
Remember: Security is continuous. Integrate automated scanning into CI/CD, conduct regular reviews, and maintain security-first development practices.