[{"skill":"devops-automator","reason":"Secure deployment pipelines"},{"skill":"mcp-creator","reason":"Secure MCP server development"}]
Security Auditor
Comprehensive security scanning for codebases. Identifies vulnerabilities before they become incidents. Focuses on actionable findings with remediation guidance.
Secret-like pattern found?
├── In test file? → Lower severity, document
├── In example/docs? → Check if placeholder
├── High entropy + near "password"/"secret" → High confidence
└── In .env.example? → Acceptable if placeholder values
3. OWASP Top 10 Static Analysis
#
Vulnerability
Detection Pattern
A01
Broken Access Control
Missing auth checks on routes
A02
Cryptographic Failures
Weak algorithms (MD5, SHA1 for passwords)
A03
Injection
Unparameterized queries, eval(), innerHTML
A04
Insecure Design
Hardcoded credentials, missing rate limits
A05
Security Misconfiguration
Debug mode in prod, default credentials
A06
Vulnerable Components
Known CVEs in dependencies
A07
Auth Failures
Weak password policies, session issues
A08
Integrity Failures
Unsigned updates, untrusted deserialization
A09
Logging Failures
Sensitive data in logs, missing audit trails
A10
SSRF
Unvalidated URL inputs to fetch/request
4. Language-Specific Checks
JavaScript/TypeScript:
eval(), new Function() - code injection
innerHTML, outerHTML - XSS vectors
document.write() - DOM-based XSS
child_process.exec() with user input - command injection
Regex without timeout - ReDoS vulnerability
Python:
pickle.loads() with untrusted data - arbitrary code execution
yaml.load() without Loader=SafeLoader - code injection
subprocess.shell=True - command injection
eval(), exec() - code injection
SQL string concatenation - SQL injection
SQL:
String concatenation in queries - SQL injection
LIKE '%' + input + '%' - injection via wildcards
Missing parameterization - critical vulnerability
Anti-Patterns
Anti-Pattern: Security by Obscurity
What it looks like: "Nobody will find this hardcoded password"
Why wrong: Secrets in source always leak eventually
Instead: Environment variables, secret managers, zero hardcoded secrets
Anti-Pattern: Audit Fatigue
What it looks like: 500 findings, all "medium", team ignores
Why wrong: Critical issues buried in noise
Instead: Prioritize by exploitability, start with critical/high only
Anti-Pattern: Fix Without Understanding
What it looks like: npm audit fix --force without review
Why wrong: May introduce breaking changes, doesn't address root cause
Instead: Review each fix, understand the vulnerability, test after
Anti-Pattern: One-Time Audit
What it looks like: "We did a security audit last year"
Why wrong: New CVEs daily, code changes constantly
Instead: CI/CD integration, weekly automated scans minimum
Security Report Format
{"summary":{"critical":0,"high":2,"medium":5,"low":12,"informational":8},"findings":[{"id":"SEC-001","severity":"high","category":"A03:Injection","title":"SQL Injection in user search","location":"src/api/users.js:45","description":"User input concatenated directly into SQL query","evidence":"const query = `SELECT * FROM users WHERE name = '${input}'`","remediation":"Use parameterized queries: db.query('SELECT * FROM users WHERE name = $1', [input])","references":["https://owasp.org/www-community/attacks/SQL_Injection"]}],"recommendations":["Implement parameterized queries across all database access","Add input validation layer","Enable SQL query logging for monitoring"]}
CI/CD Integration
GitHub Actions Example
security-scan:runs-on:ubuntu-lateststeps:-uses:actions/checkout@v4-name:Runsecurityauditrun:|
npm audit --json > audit.json
./scripts/detect-secrets.sh . > secrets.json
./scripts/generate-report.py
-name:Failoncriticalrun:|
if jq '.summary.critical > 0' report.json; then
echo "Critical vulnerabilities found!"
exit 1
fi
