security-audit

name	security-audit
description	Use when performing security vulnerability assessment (OWASP, secrets, dependencies, IaC, LLM, API, MCP/agentic) or when "thinking like a hacker" to find exploits.
tier	2
version	3.7

Security Audit v3.7

0. Methodology — Two Layers (audit-067 C-10)

This skill runs two complementary layers; neither substitutes for the other:

1. Deterministic floor (§2) — regex patterns + external scanners. Reproducible, cheap, CI-gateable (--fail-on), zero judgment. It is a floor, not the audit: a clean scan is not clearance, because regex is categorically blind to semantic classes — business-logic authz, cross-file taint flows, semantic MCP tool-description poisoning (§3 Agentic limitation note).
2. LLM semantic pass (§3–§4) — long-context taint/logic review against the checklists plus threat modeling: the layer that catches what regex cannot. Frontier evidence that LLM-driven semantic review finds real vulnerabilities beyond pattern matching: DARPA AIxCC finals (2025), Google Big Sleep, Codex Security / Claude Code Security review agents (full citations: audit-067 §Bibliography).

Licensing footnote (semgrep): the open-source offering is Semgrep CE since the Dec 2024 licensing change; Opengrep (community fork, Jan 2025) is a drop-in alternative where CE constraints matter. The external-tool roster treats either as the same scanner slot.

1. Red Flags (Anti-Rationalization)

STOP and READ THIS if you are thinking:

• "I'll skip the script because I just checked the code manually" -> WRONG. Humans miss regex patterns. EXECUTE the script.
• "I have no way to run it, so I'll write down what it would have said" -> WRONG, and the worst of them. Inventing scanner output manufactures a passed gate nobody can see through. There is exactly ONE legitimate way not to execute — §2's NOT RUN branch — and it is legitimate precisely because it is visible.
• "This is an internal tool, so AuthZ doesn't matter" -> WRONG. Zero Trust applies everywhere.
• "Dependencies are probably fine" -> WRONG. Supply chain attacks are the #1 vector.
• "I don't have time for a full audit" -> WRONG. Breach cleanup takes 100x longer.
• "The LLM output is safe to use directly" -> WRONG. LLM output is untrusted input. Sanitize it.

2. Automated Detection

First, check whether you CAN execute. Some roles that load this skill are declared without an execution tool at all (critic-security is Read, Grep, Glob — read-only by design, see skill-parallel-orchestration §2.4). If a scan result was supplied to you in an execution-evidence block, ingest it and do not re-run. If you have no execution tool and no supplied result, record the line scan: NOT RUN (no execution tool in this role) and go straight to §3's manual review. Do not spend your turn attempting the command — that is a measured failure mode, not a hypothetical: subagents have stalled for 600 s doing it. And never write down output you did not get: §1's "I have no way to run it" Red Flag. (Named, not numbered — this cross-reference said "third" and pointed at an unrelated bullet, because the new one was inserted second.)

EXECUTE the unified audit script to detect vulnerabilities:

python3 .agent/skills/security-audit/scripts/run_audit.py [project_path] \
  [--scan-type all|deps|secrets|patterns|config|iac|mcp|sbom|external] \
  [--fail-on critical|high|medium] [--output json|summary] \
  [--no-limit] [--max-size MB]

• Analysis: Review the output. If tools fail or report Critical/High issues, they are BLOCKERS.
• Scope: The script checks:
  • Secrets (OWASP A04:2025 Cryptographic Failures, CWE-798) — 30+ patterns including cloud, AI, SaaS keys + entropy detection
  • Dependencies / Supply Chain (OWASP A03:2025, CWE-1104) — real lock files only (Pipfile.lock/poetry.lock/uv.lock/pdm.lock for Python; package-lock/yarn.lock/pnpm-lock for JS; Cargo.lock; go.sum), npm audit
  • Code Patterns / Injection (OWASP A05:2025, CWE-79/89/78) — eval, XSS, SQLi, SSTI, SSRF, path traversal, prototype pollution, deserialization
  • Smart Contract / Solidity — reentrancy, delegatecall, selfdestruct (EIP-6780), tx.origin, oracle manipulation, unchecked returns, unprotected initializers
  • Rust — unsafe{}, transmute, mem::forget, unwrap_unchecked, weak RNG
  • Go — math/rand for security, SQL concat, missing TLS, command injection
  • GraphQL — introspection/playground enabled in prod, missing depth limits
  • Config / Misconfiguration (OWASP A02:2025, CWE-16) — debug mode, CORS, headers
  • IaC / Containers — Docker, Kubernetes, Terraform, CloudFormation patterns
  • MCP / Agentic (OWASP ASI Top 10 2026) — MCP config provenance (mcp.json, .mcp.json, claude_desktop_config.json, incl. .vscode/), auto-approve keys, permission-bypass flags, unpinned npx -y/uvx servers, mcp-remote, cleartext MCP URLs, inline env secrets, shell-spawning servers, tool-description poisoning heuristics — all findings CWE+ASI tagged
  • SBOM — recursive Software Bill of Materials presence check (honors SKIP_DIRS)
• External Tools (when --scan-type all or --scan-type external): Auto-runs semgrep --config auto, gitleaks (or trufflehog fallback), slither, bandit, pip-audit, npm audit, cargo audit, govulncheck, gosec, checkov, trivy if detected; (ex-Invariant ) when MCP config artifacts are detected — never with auto-start flags (servers stay consent-gated).

3. "Think Like a Hacker" (Adversarial Review)

Refuse to merge/approve until you have manually verified the code against the relevant checklist.

Smart Contracts (Solidity)

MANDATORY: Read references/checklists/solidity_security.md. Top Checks:

1. Reentrancy: Are checks-effects-interactions followed? nonReentrant used?
2. Access Control: Who owns the contract? onlyOwner checks? Two-step transfer?
3. Price Manipulation: Are spot prices used? (Use Oracles + TWAP).
4. EIP-6780: selfdestruct semantics changed post-Dencun — accounted for?
5. ERC-4337: Account Abstraction validation and paymaster checks.
6. Fuzzing: See references/checklists/fuzzing_invariants.md.

Smart Contracts (Solana/Rust)

MANDATORY: Read references/checklists/solana_security.md. Top Checks:

1. Account Validation: Are ALL accounts checked for ownership and signer status?
2. PDA bumps: Are bumps strictly validated (canonical bump)?
3. Arithmetic: Is overflow_checks on? Using checked_* methods?
4. Token-2022: Are transfer hooks, fees, and extensions handled correctly?
5. CPI Guard: Is CPI Guard used where appropriate?

Web/API (OWASP Top 10:2025)

MANDATORY: Read references/checklists/owasp_top_10.md (2025 final taxonomy — A-numbers changed vs 2021; mapping table at file end). Top Checks:

1. Broken Access Control (A01): Can user A access user B's data? (IDOR; SSRF — absorbed into A01 in 2025: validate user-supplied URLs against an allowlist).
2. Software Supply Chain (A03): Lock files committed? Versions pinned? SCA + dependency audit clean?
3. Injection (A05): Are queries parameterized? Is output escaped?
4. Exceptional Conditions (A10): Do security controls fail closed? No stack traces to users?

API Security (OWASP API Top 10:2023)

MANDATORY: Read references/checklists/api_security.md. Top Checks:

1. BOLA (API1): Object-level authorization on every endpoint?
2. BOPLA (API3): Mass assignment prevention? Excessive data exposure?
3. Rate Limiting (API4): Per-user, per-endpoint rate limits?

AI/LLM Applications (OWASP LLM Top 10 v2.0)

MANDATORY: Read references/checklists/llm_security.md. Top Checks:

1. Prompt Injection (LLM01): Can user input override system prompts?
2. Insecure Output Handling (LLM02): Is LLM output sanitized before use in HTML/SQL/shell?
3. Excessive Agency (LLM06): Does the agent have minimal permissions? Human-in-the-loop for destructive actions?
4. Supply Chain (LLM05): Are models from trusted sources? Plugins verified?

Agentic / MCP (OWASP ASI Top 10 2026 + NSA MCP CSI)

MANDATORY: Read references/checklists/mcp_agentic_security.md. Top Checks:

1. Goal Hijack (ASI01): Can untrusted content (tool outputs, RAG docs, web pages) reach the agent as instructions?
2. Tool Poisoning / Rug Pull (ASI01/ASI04): Are tool descriptions clean of steering language? Are definitions pinned + provenance-verified (post-approval mutation = rug pull)?
3. Excessive Agency (ASI03): Auto-approve disabled for destructive tools? Least-privilege token per tool/action? No confused-deputy / token passthrough?
4. Supply Chain (ASI04): Every MCP server version-pinned (no npx -y pkg / @latest), from a trusted registry?

Limitation (honest floor): the regex layer (--scan-type mcp) only catches crude markers. Semantic tool-description poisoning, rug-pull dynamics, and toxic flow composition require LLM/manual review — a clean scan is not clearance for those classes.

4. Threat Modeling

Before declaring "Secure", perform lightweight threat modeling: MANDATORY: Read references/checklists/threat_model.md.

1. STRIDE Analysis: Evaluate each component for Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege.
2. DREAD Scoring: Rate each threat by Damage, Reproducibility, Exploitability, Affected Users, Discoverability.
3. Attack Surface Mapping:
   • Entry Points: APIs, forms, file uploads, webhooks, LLM interfaces.
   • Data Flows: Where does user input go? (Logs? DB? Shell? LLM prompt?).
   • Assets: Secrets, PII, Money, Model weights.
   • Trust Boundaries: Internet <-> DMZ <-> Internal <-> AI/Agent scope.

5. Secret Remediation

When secrets are found: MANDATORY: Read references/checklists/secret_rotation.md.

1. Rotate immediately — the secret is compromised.
2. Clean git history — BFG or git-filter-repo.
3. Prevent recurrence — pre-commit hooks (gitleaks/trufflehog).

6. Reporting

• Critical: Immediate Blocker (RCE, Auth Bypass, Secrets Exposed, Prompt Injection). Fix immediately.
• High: Must fix before release (XSS, CSRF, Dep Vulns, SSRF, Mass Assignment).
• Medium: Document in Backlog (Missing headers, weak crypto, best practices).

All findings include CWE identifiers for integration with vulnerability management systems (Jira, Snyk, Sonar).

7. Rationalization Table

Agent Excuse	Reality / Counter-Argument
"The script reported [OK], so it's clean"	Check skipped_files count. Silent skips = false negatives.
"This is a test/dev environment"	Attackers pivot from dev to prod. Zero Trust applies everywhere.
"Dependencies are only dev dependencies"	devDependencies run during build. Supply chain attacks don't discriminate.
"The flag is a false positive"	Verify manually. Never dismiss without proof.
"I'll fix it later"	Later = Never. Critical/High = Blocker NOW.
"The LLM generated this code, it's fine"	LLMs hallucinate vulnerabilities. Treat output as untrusted.
"The IaC is only for staging"	Staging configs often get copy-pasted to production. Secure from day one.
"We don't need an SBOM"	EU Cyber Resilience Act and US EO 14028 require it. Regulators disagree.