security-review

name	security-review
description	Security audit of the project or specified scope

Run a security audit on the current project or specified scope: the task/scope the user described when invoking this skill (if none given, ask or infer from context)

Identify vulnerabilities yourself using the process below. Be evidence-based — cite file:line for every finding.

Scan Targets

1. Secrets: API keys, passwords, tokens in code or config
2. Injection: SQL, NoSQL, command, LDAP, XPath injection
3. XSS: Reflected, stored, DOM-based
4. Auth: Broken authentication, session management issues
5. Access Control: Missing authorization checks, IDOR
6. Data Exposure: Sensitive data in logs, errors, responses
7. Dependencies: Known vulnerable packages
8. Configuration: Debug mode in production, CORS misconfiguration

Process

1. Scan for hardcoded secrets (multiple file types in one pass):

   grep -rniE "password|secret|api_key|apikey|token|private_key" \
     --include="*.js" --include="*.ts" --include="*.jsx" --include="*.tsx" \
     --include="*.py" --include="*.go" --include="*.rb" --include="*.env" .
   

   (or rg -ni "password|secret|api_key|apikey|token|private_key" -g '*.{js,ts,jsx,tsx,py,go,rb,env}')
2. Check .env files are gitignored; look for committed credentials.
3. Review authentication and session flows.
4. Check input validation on API endpoints.
5. Review database queries for injection (string-concatenated SQL).
6. Check dependency vulnerabilities: npm audit / pip-audit / govulncheck or equivalent.
7. Review CORS and security headers.

Output

Severity scale (canonical): CRITICAL / WARNING / INFO.

• CRITICAL — exploitable now or on deployment (secrets in code, injection, broken auth/access control). Blocks release.
• WARNING — should be fixed soon (weak config, missing hardening, limited-impact data exposure).
• INFO — advisory / hygiene.

## Security Audit Report

### CRITICAL
[Immediate action required — blocks deployment]

### WARNING
[Should be fixed soon]

### INFO
[Advisory / good to fix when convenient]

### Secure Patterns Found
[Positive findings — things done well]

Include remediation steps for each finding.