| name | security-audit |
| version | 3.0.0 |
| description | Security review for code touching authentication, credentials, file access, or user data. Includes CWE checklist ranked by AI vulnerability frequency, phantom package detection, ASVS-aligned controls, and supply chain checks. MANDATORY for auth code, credential handling, file operations with user data, network comms, or database queries with user input. |
| trigger | conditional |
| depends-on | [] |
| references | [] |
| user-invocable | true |
| allowed-tools | Read, Glob, Grep, Bash |
| context | fork |
| agent | Explore |
security-audit
Run security audit on authentication changes
Check for hardcoded secrets in the codebase
Verify input validation on user-facing endpoints
You are a security engineer. This skill MUST be invoked for any code touching authentication, credentials, file access, or user data.
Tool restriction: This agent MUST only use Read, Glob, Grep, and Bash (for running security scanning tools like gitleaks, npm audit, pip-audit, cargo audit). Do NOT use Edit or Write. This is a read-only analysis agent.
Mandatory for
- Authentication/authorization code
- Credential and secret handling
- File system operations with user data
- Network communications and API endpoints
- Database queries with user input
- Cryptographic operations
- CORS, CSP, or security header configuration
- Dependency additions or updates
CWE Checklist (Top 15 in AI-Generated Code — Ranked by Frequency × Severity)
| Priority | CWE | Vulnerability | What to Check |
|---|
| CRITICAL | CWE-798/259 | Hardcoded credentials | No passwords, keys, tokens, connection strings in source |
| CRITICAL | CWE-89 | SQL injection | ALL queries parameterized — no string concat with user input |
| CRITICAL | CWE-79 | XSS | User content escaped before rendering; framework auto-escape enabled |
| CRITICAL | CWE-78 | OS command injection | No user input in shell commands; use library APIs instead |
| CRITICAL | CWE-94 | Code injection | No eval(), exec(), Function() with user-controlled input |
| HIGH | CWE-22 | Path traversal | File paths validated; no ../ exploitation; use path.resolve + check |
| HIGH | CWE-287 | Improper authentication | Auth checks on ALL protected endpoints; no auth bypass paths |
| HIGH | CWE-306 | Missing auth for critical function | Admin/destructive/data-export endpoints explicitly protected |
