security-audit

name	Security Audit
description	Review code and architecture for security vulnerabilities using OWASP guidelines
version	1.0
tags	["engineering","security","quality"]
complexity	advanced
requires_tools	["mcp:filesystem:*"]

Process

1. Map the attack surface — Identify entry points (APIs, forms, file uploads, auth endpoints)
2. OWASP Top 10 check:
   • Injection: SQL, NoSQL, OS command, LDAP injection
   • Broken Authentication: Weak passwords, session management, credential exposure
   • Sensitive Data Exposure: Unencrypted data, hardcoded secrets, verbose errors
   • XML/XXE: External entity processing
   • Broken Access Control: Missing authorization checks, IDOR, privilege escalation
   • Security Misconfiguration: Default credentials, unnecessary features, missing headers
   • XSS: Reflected, stored, DOM-based cross-site scripting
   • Insecure Deserialization: Untrusted data deserialization
   • Known Vulnerabilities: Outdated dependencies with CVEs
   • Insufficient Logging: Missing audit trails, no alerting
3. Check secrets management — Hardcoded keys, tokens in source, .env in git
4. Review auth/authz — Token validation, session handling, role checks
5. Check input validation — All user inputs sanitized and validated
6. Dependency audit — Check for known vulnerabilities in dependencies

Output Format

## Security Audit Report

**Scope**: [Files/components reviewed]
**Risk Level**: Critical / High / Medium / Low

### Findings

#### [CRITICAL] Finding Title
- **Location**: file:line
- **Vulnerability**: [OWASP category]
- **Impact**: [What an attacker could do]
- **Remediation**: [Specific fix with code example]

#### [HIGH] Finding Title
...

### Summary
- Critical: N findings
- High: N findings
- Medium: N findings
- Low: N findings

### Recommendations
1. [Priority-ordered action items]

Guidelines

• Always check for hardcoded secrets first — they're the most common critical finding
• Test input validation at every boundary (API params, form fields, file names)
• Verify that error messages don't leak internal details
• Check that all endpoints have proper authentication AND authorization
• Review dependencies for known CVEs
• Look for debug/development code left in production paths