---

name: security-audit description: Security review of application code, dependencies, configurations, and architecture. Covers OWASP Top 10, dependency scanning, secret management, authentication patterns, and API security. Use this skill when reviewing security of code, auditing dependencies for vulnerabilities, checking configuration security, assessing API endpoints, or answering security concerns about implementations. Triggers on "security", "audit", "vulnerability", "CVE", "OWASP", "injection", "XSS", "CSRF", "authentication security", "authorization flaw".

Security Audit

Systematic security review for application code, dependencies, and configuration.

This skill is NOT a replacement for professional penetration testing or security audits. It identifies common vulnerabilities and provides remediation guidance within the scope of code review.

Audit Process

Copy┌─────────────────────────────────────────────────────────────┐
│                    SECURITY AUDIT                            │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  1. SCOPE           2. SCAN              3. ANALYZE         │
│  ┌─────────────┐   ┌─────────────┐      ┌─────────────┐    │
│  │ Define area │ → │ Run tools   │  →   │ Review      │    │
│  │ Set depth   │   │ Check deps  │      │ findings    │    │
│  │ Identify    │   │ Grep code   │      │ Classify    │    │
│  │ constraints │   │             │      │ severity    │    │
│  └─────────────┘   └─────────────┘      └─────────────┘    │
│                                                             │
│  4. REMEDIATE       5. DOCUMENT                             │
│  ┌─────────────┐   ┌─────────────┐                         │
│  │ Fix critical│ → │ Report      │                         │
│  │ Create      │   │ Create ohno │                         │
│  │ guidance    │   │ tasks       │                         │
│  └─────────────┘   └─────────────┘                         │
│                                                             │
└─────────────────────────────────────────────────────────────┘

Audit Types

Quick Start Checklist

Run through this checklist for any security review:

Critical (P0)

• No hardcoded secrets in code or config files
• SQL queries use parameterized statements
• User input is validated and sanitized
• Authentication tokens have expiration
• Sensitive routes require authentication
• Dependencies have no known critical CVEs

High Priority (P1)

• CORS configured restrictively (not *)
• CSRF protection on state-changing operations
• Rate limiting on authentication endpoints
• Error messages don't leak internal details
• Logging doesn't include sensitive data
• File uploads validated (type, size, content)

Medium Priority (P2)

• Security headers configured (CSP, HSTS, etc.)
• Cookies have Secure, HttpOnly, SameSite flags
• Password requirements meet standards
• Session timeout configured
• Input length limits enforced

Severity Classification

Severity Decision Tree

CopyIs there a known exploit?
├── Yes → Can attacker access sensitive data or execute code?
│         ├── Yes → Without authentication? → CRITICAL
│         │         └── With authentication → HIGH
│         └── Limited impact → MEDIUM
└── No → Is it a security best practice violation?
         ├── Could lead to future vulnerability → LOW
         └── Cosmetic/informational → INFO

Code Review Patterns

Injection Detection

Search patterns for common injection vulnerabilities:

Copy# SQL Injection (string concatenation in queries)
grep -rn "SELECT.*\+" --include="*.ts" --include="*.js"
grep -rn "INSERT.*\+" --include="*.ts" --include="*.js"
grep -rn "query\s*(\s*['\`]" --include="*.ts" --include="*.js"

# Command Injection
grep -rn "exec\s*(" --include="*.ts" --include="*.js"
grep -rn "spawn\s*(" --include="*.ts" --include="*.js"
grep -rn "child_process" --include="*.ts" --include="*.js"

# Path Traversal
grep -rn "\.\./" --include="*.ts" --include="*.js"
grep -rn "req\.\(params\|query\|body\).*path" --include="*.ts"

Authentication/Authorization Flaws

Copy# Missing auth checks
grep -rn "router\.\(get\|post\|put\|delete\)" --include="*.ts" | grep -v "auth"

# Hardcoded credentials
grep -rn "password\s*=" --include="*.ts" --include="*.env*"
grep -rn "api_key\s*=" --include="*.ts" --include="*.js"
grep -rn "secret\s*=" --include="*.ts" --include="*.js"

# JWT issues
grep -rn "algorithm.*none" --include="*.ts" --include="*.js"
grep -rn "verify.*false" --include="*.ts" --include="*.js"

Sensitive Data Exposure

Copy# Logging sensitive data
grep -rn "console\.log.*password" --include="*.ts"
grep -rn "console\.log.*token" --include="*.ts"
grep -rn "logger.*req\.body" --include="*.ts"

# Exposing stack traces
grep -rn "stack" --include="*.ts" | grep -v "node_modules"
grep -rn "Error\s*(" --include="*.ts" | grep "res\.\(send\|json\)"

Dependency Audit

npm/Node.js

Copy# Built-in audit
npm audit
npm audit --json > audit-results.json

# Check for outdated
npm outdated

# Detailed view of vulnerabilities
npm audit --audit-level=moderate

Interpreting npm audit

False positives: Some vulnerabilities are in dev dependencies or don't affect your usage. Document exclusions with justification.

Python

Copy# pip-audit
pip-audit
pip-audit --format=json > audit-results.json

# Safety check
safety check
safety check --full-report

See references/dependency-security.md for Snyk integration, CI/CD setup, and CVE tracking.

Configuration Review

Secrets Detection

Copy# Git secrets scan
git secrets --scan

# Trufflehog (history scan)
trufflehog git file://. --json

# Gitleaks
gitleaks detect --source . --verbose

Common Secret Patterns

See references/secrets-management.md for proper secret management patterns.

API Security Checklist

Authentication

• Tokens expire (reasonable TTL)
• Refresh token rotation implemented
• Password reset tokens single-use
• Account lockout after failed attempts
• Secure password storage (bcrypt, argon2)

Authorization

• Every endpoint has explicit auth check
• Resource ownership validated (no IDOR)
• Role checks on sensitive operations
• API keys have scoped permissions

Input Validation

• Request body schema validated
• Query params sanitized
• File uploads restricted (type, size)
• No arbitrary object property access

Rate Limiting

• Auth endpoints rate limited
• API calls rate limited per user/IP
• Expensive operations throttled
• Rate limit headers exposed

See references/api-security.md for detailed API security patterns.

Audit Report Template

Copy# Security Audit Report

## Summary
| Metric | Count |
|--------|-------|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |
| **Total** | X |

**Scope**: [What was audited]
**Date**: [Date]
**Auditor**: [Agent/Human]

## Critical Findings

### [VULN-001]: [Brief Title]
- **Severity**: Critical
- **Category**: [OWASP category]
- **Location**: `path/to/file.ts:123`
- **Description**: [What's wrong]
- **Impact**: [What an attacker could do]
- **Remediation**: [How to fix]
- **Code Sample**:
  ```typescript
  // Vulnerable
  const user = await db.query(`SELECT * FROM users WHERE id = ${id}`);
  
  // Fixed
  const user = await db.query('SELECT * FROM users WHERE id = $1', [id]);

[Repeat for each finding]

Recommendations

Immediate Actions

1. [Action with ohno task link]

Short-term (1-2 weeks)

1. [Action]

Long-term

1. [Action]

Copy
## Integration with pokayokay

### Task Creation

Create ohno tasks for findings with appropriate priority:

```bash
# Critical finding
ohno add "VULN-001: SQL injection in user lookup" -p P0 -t security

# High finding  
ohno add "VULN-002: Missing rate limiting on /api/auth" -p P1 -t security

# Medium finding
ohno add "VULN-003: CORS configured too permissively" -p P2 -t security

Skill Routing

This skill routes from:

• Keywords: "security", "audit", "vulnerability", "CVE"
• Task types containing "security" in tasks.db
• Features with security implications in their description

Multi-Skill Workflow

Security audit often follows other skills:

Copy1. api-design      → Design endpoints
2. security-audit  → Review endpoint security
3. api-testing     → Include security test cases

Out of Scope

This skill does NOT cover:

• Penetration testing or active exploitation
• Compliance certifications (SOC2, HIPAA, PCI-DSS)
• Network security and firewall configuration
• Physical security
• Social engineering assessment
• Mobile app security (use platform-specific tools)

For compliance requirements, engage professional security auditors.

References

• references/owasp-top-10.md — OWASP vulnerabilities with detection and fixes
• references/dependency-security.md — npm audit, pip-audit, Snyk, CI/CD integration
• references/auth-patterns.md — Secure authentication and authorization patterns
• references/api-security.md — API-specific security concerns
• references/secrets-management.md — Handling sensitive configuration