security-audit

ils15's avatarfrom ils15

Audit code for security vulnerabilities using OWASP Top 10, STRIDE threat modeling, and secure coding practices. Identifies SQL injection, XSS, CSRF, auth issues, and secrets exposure. Returns prioritized findings with remediation.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 23, 2025⬇️1downloads
[Security Operations]

When & Why to Use This Skill

The Security Audit skill is a specialized tool designed to identify, analyze, and remediate security vulnerabilities within source code. By implementing industry-standard frameworks like the OWASP Top 10 and STRIDE threat modeling, it detects critical risks including SQL injection, XSS, CSRF, and sensitive data exposure. It provides developers with a prioritized severity report and actionable code fixes to strengthen application defenses and ensure secure coding compliance.

Use Cases

  • Pre-merge Security Reviews: Automatically scan pull requests for OWASP Top 10 vulnerabilities to prevent insecure code from reaching production.
  • Threat Modeling Analysis: Use the STRIDE framework to evaluate new features for potential spoofing, tampering, or elevation of privilege risks during the design phase.
  • Secret and Credential Detection: Identify hardcoded API keys, passwords, and exposed secrets within the codebase to prevent unauthorized access.
  • Compliance and Audit Reporting: Generate detailed security audit reports with prioritized findings and remediation steps for internal security reviews or external compliance requirements.
  • Input Validation and API Hardening: Review API endpoints and database queries to ensure proper input sanitization, rate limiting, and protection against injection attacks.
namesecurity-audit
descriptionAudit code for security vulnerabilities using OWASP Top 10, STRIDE threat modeling, and secure coding practices. Identifies SQL injection, XSS, CSRF, auth issues, and secrets exposure. Returns prioritized findings with remediation.

Security Audit Skill

When to Use

Use this skill when:

  • Reviewing code for security vulnerabilities
  • Auditing authentication/authorization logic
  • Checking for secrets exposure in code
  • Validating input sanitization
  • Reviewing API security (rate limiting, CORS)
  • Assessing database query safety
  • Evaluating encryption and hashing

OWASP Top 10 Checklist

A01: Broken Access Control

✅ Checks:
- [ ] Role-based access control (RBAC) implemented
- [ ] JWT validation on all protected endpoints
- [ ] Authorization checks in service layer
- [ ] No direct object references exposed
- [ ] Admin functions protected

A02: Cryptographic Failures

✅ Checks:
- [ ] Passwords hashed with bcrypt/argon2
- [ ] Secrets in environment variables (not code)
- [ ] HTTPS enforced
- [ ] Sensitive data encrypted at rest
- [ ] No hardcoded API keys

A03: Injection

✅ Checks:
- [ ] Parameterized SQL queries (SQLAlchemy ORM)
- [ ] Input validation with Pydantic
- [ ] No string concatenation in queries
- [ ] Command injection prevented
- [ ] XSS sanitization on output

A04: Insecure Design

✅ Checks:
- [ ] Rate limiting implemented
- [ ] CORS properly configured
- [ ] Error messages don't leak info
- [ ] Defense in depth applied
- [ ] Fail-secure defaults

A07: Authentication Failures

✅ Checks:
- [ ] Strong password policy
- [ ] Account lockout after failures
- [ ] Session timeout configured
- [ ] MFA available
- [ ] Secure password reset flow

STRIDE Threat Model

S - Spoofing: Can attacker impersonate user?
T - Tampering: Can attacker modify data?
R - Repudiation: Can actions be traced?
I - Information Disclosure: Can data leak?
D - Denial of Service: Can system be crashed?
E - Elevation of Privilege: Can attacker gain admin?

Output Format

## Security Audit Report

### Severity Summary
- 🔴 Critical: X findings
- 🟠 High: X findings
- 🟡 Medium: X findings
- 🟢 Low: X findings

### Findings

#### [SEV-001] SQL Injection in user_service.py:45
- **Severity**: Critical
- **OWASP**: A03 Injection
- **Location**: `backend/services/user_service.py:45-50`
- **Issue**: String concatenation in SQL query
- **Remediation**: Use parameterized query
- **Code Fix**:
```python
# Before (vulnerable)
query = f"SELECT * FROM users WHERE id = {user_id}"

# After (secure)
query = select(User).where(User.id == user_id)

Recommendations

  1. [Priority 1 fix]
  2. [Priority 2 fix]

## Example Usage

@security Audit the authentication module for vulnerabilities @security Check for secrets exposure in the codebase @security Review API endpoints for injection risks @security Validate CORS configuration