security-audit
Identify and fix security vulnerabilities in code and infrastructure
When & Why to Use This Skill
The Security Audit skill is a comprehensive tool designed to identify and remediate security vulnerabilities across application code and infrastructure. It automates critical checks for SQL injection, Cross-Site Scripting (XSS), hardcoded credentials, and insecure database configurations, helping developers maintain a robust security posture throughout the development lifecycle.
Use Cases
- Automated Code Reviews: Scan source code for hardcoded API keys, secrets, and insecure coding patterns like dangerouslySetInnerHTML before merging pull requests.
- Dependency Management: Perform regular audits of project dependencies using tools like 'npm audit' to identify and update vulnerable packages automatically.
- Database & Infrastructure Hardening: Verify that Row Level Security (RLS) is enabled on all tables and ensure environment variables are properly masked and excluded from logs.
- Pre-release Compliance: Execute a systematic security checklist covering input validation, CSRF protection, and rate limiting to meet industry security standards.
| name | Security Audit |
|---|---|
| description | Identify and fix security vulnerabilities in code and infrastructure |
Security Audit Skill
Identify security vulnerabilities and implement fixes.
Check List
Code Security
- No hardcoded credentials/API keys
- Input validation on all user inputs
- SQL injection prevention (parameterized queries)
- XSS prevention (sanitize outputs)
- CSRF tokens where needed
- Rate limiting on APIs
- Authentication on sensitive routes
- Authorization checks (user permissions)
Database Security
- RLS enabled on ALL tables
- Service role key never exposed to client
- Policies prevent data leaks
- Encrypted connections (SSL/TLS)
Environment Security
-
.env.localin.gitignore - Secrets in environment variables only
- No secrets in logs
- HTTPS in production
Dependencies
- Run
npm audit - Update vulnerable packages
- Review package permissions
Common Vulnerabilities
SQL Injection
// BAD
const query = `SELECT * FROM users WHERE id = ${userId}`;
// GOOD
const { data } = await supabase
.from('users')
.select('*')
.eq('id', userId);
XSS
// BAD
<div dangerouslySetInnerHTML={{__html: userInput}} />
// GOOD
<div>{userInput}</div> // Auto-escaped by React
Credential Leaks
// BAD
const apiKey = "sk-1234567890abcdef";
// GOOD
const apiKey = process.env.API_KEY;
Quick Audit
"Run security audit:
1. Search for hardcoded secrets (grep for 'sk-', 'api_key', etc.)
2. Check .gitignore includes .env*
3. Verify RLS on all tables
4. Run npm audit
5. Check CORS config
Output: temp/security/audit-{timestamp}.md"
Remember: Security is not optional. Audit regularly!