Security Audit

Use this skill when the user asks to audit security, check for vulnerabilities, review code for security issues, or harden an application.

Steps

Scan for hardcoded secrets — search for API keys, tokens, passwords, and connection strings in source files. Check for patterns like:
- ```
password=
```
  ,
```
secret=
```
  ,
```
token=
```
  ,
```
api_key=
```
- Base64-encoded credentials
- AWS keys (
```
AKIA...
```
  ), Stripe keys (
```
sk_live_...
```
  ), GitHub tokens (
```
ghp_...
```
  )
- Files:
```
.env
```
  committed to git,
```
config.json
```
  with credentials
Check authentication & authorization
- Verify all API routes check authentication before processing.
- Ensure role-based access control is enforced server-side, not just in the UI.
- Check that password hashing uses bcrypt/argon2 (not MD5/SHA1).
- Verify session tokens are HTTP-only, secure, and have reasonable expiry.
Check for injection vulnerabilities
- SQL injection: look for string concatenation in SQL queries instead of parameterized queries.
- XSS: look for
```
dangerouslySetInnerHTML
```
  ,
```
innerHTML
```
  , or unescaped user input rendered in templates.
- Command injection: look for
```
exec()
```
  ,
```
eval()
```
  ,
```
child_process.exec()
```
  with user input.
- Path traversal: check file operations for unsanitized user input in paths.
Review dependency security
- Run
```
npm audit
```
  or
```
pip audit
```
  to check for known vulnerabilities.
- Flag outdated dependencies with known CVEs.
- Check for overly permissive dependency ranges.
Check CORS and CSP configuration
- Verify CORS doesn't use
```
Access-Control-Allow-Origin: *
```
  in production.
- Check for Content Security Policy headers.
- Verify
```
X-Frame-Options
```
  ,
```
X-Content-Type-Options
```
  , and
```
Strict-Transport-Security
```
  headers.
Review data exposure
- Check API responses for leaking sensitive fields (password hashes, internal IDs, PII).
- Verify error messages don't expose stack traces or internal details in production.
- Check logging for sensitive data being written to logs.
Generate report — produce a summary with severity ratings (Critical / High / Medium / Low) for each finding, with the file path, line number, and recommended fix.

Notes

This is a code review, not a penetration test. Recommend tools like
```
npm audit
```
,
```
trivy
```
, or
```
snyk
```
for automated scanning.
Always check
```
.gitignore
```
to ensure
```
.env
```
, credentials, and key files are excluded.
For comprehensive auditing, recommend the OWASP Testing Guide.

auditing-security

NPX Install

Tags

SKILL.md Content

Security Audit

Steps

Notes