Security Auditor

Expert in identifying security vulnerabilities following OWASP Top 10 and security best practices.

When This Skill Activates

Activates when you:

• Request a security audit

• Mention "security" or "vulnerability"

• Need security review

• Ask about OWASP

OWASP Top 10 Coverage

A01: Broken Access Control

Checks:

# Check for missing auth on protected routes

grep -r "@RequireAuth\|@Protected" src/

# Check for IDOR vulnerabilities

grep -r "req.params.id\|req.query.id" src/

# Check for role-based access

grep -r "if.*role.*===" src/

Common Issues:

• Missing authentication on sensitive endpoints

• IDOR: Users can access other users' data

• Missing authorization checks

• API keys in URL

A02: Cryptographic Failures

Checks:

# Check for hardcoded secrets

grep -ri "password.*=.*['\"]" src/

grep -ri "api_key.*=.*['\"]" src/

grep -ri "secret.*=.*['\"]" src/

# Check for weak hashing

grep -r "md5\|sha1" src/

# Check for http URLs

grep -r "http:\/\/" src/

Common Issues:

• Hardcoded credentials

• Weak hashing algorithms (MD5, SHA1)

• Unencrypted sensitive data

• HTTP instead of HTTPS

A03: Injection

Checks:

# SQL injection patterns

grep -r "\".*SELECT.*+.*\"" src/

grep -r "\".*UPDATE.*SET.*+.*\"" src/

# Command injection

grep -r "exec(\|system(\|spawn(" src/

grep -r "child_process.exec" src/

# Template injection

grep -r "render.*req\." src/

Common Issues:

• SQL injection

• NoSQL injection

• Command injection

• XSS (Cross-Site Scripting)

• Template injection

A04: Insecure Design

Checks:

# Check for rate limiting

grep -r "rateLimit\|rate-limit\|throttle" src/

# Check for 2FA

grep -r "twoFactor\|2fa\|mfa" src/

# Check for session timeout

grep -r "maxAge\|expires\|timeout" src/

Common Issues:

• No rate limiting on auth endpoints

• Missing 2FA for sensitive operations

• Session timeout too long

• No account lockout after failed attempts

A05: Security Misconfiguration

Checks:

# Check for debug mode

grep -r "DEBUG.*=.*True\|debug.*=.*true" src/

# Check for CORS configuration

grep -r "origin.*\*" src/

# Check for error messages

grep -r "console\.log.*error\|console\.error" src/

Common Issues:

• Debug mode enabled in production

• Overly permissive CORS

• Verbose error messages

• Default credentials not changed

A06: Vulnerable Components

Checks:

# Check package files

cat package.json | grep -E "\"dependencies\"|\"devDependencies\""

cat requirements.txt

cat go.mod

# Run vulnerability scanner

npm audit

pip-audit

Common Issues:

• Outdated dependencies

• Known vulnerabilities in dependencies

• Unused dependencies

• Unmaintained packages

A07: Authentication Failures

Checks:

# Check password hashing

grep -r "bcrypt\|argon2\|scrypt" src/

# Check password requirements

grep -r "password.*length\|password.*complex" src/

# Check for password in URL

grep -r "password.*req\." src/

Common Issues:

• Weak password hashing

• No password complexity requirements

• Password in URL

• Session fixation

A08: Software/Data Integrity

Checks:

# Check for subresource integrity

grep -r "integrity\|crossorigin" src/

# Check for signature verification

grep -r "verify.*signature\|validate.*token" src/

Common Issues:

• No integrity checks

• Unsigned updates

• Unverified dependencies

A09: Logging Failures

Checks:

# Check for sensitive data in logs

grep -r "log.*password\|log.*token\|log.*secret" src/

# Check for audit trail

grep -r "audit\|activity.*log" src/

Common Issues:

• Sensitive data in logs

• No audit trail for critical operations

• Logs not protected

• No log tampering detection

A10: SSRF (Server-Side Request Forgery)

Checks:

# Check for arbitrary URL fetching

grep -r "fetch(\|axios(\|request(\|http\\.get" src/

# Check for webhook URLs

grep -r "webhook.*url\|callback.*url" src/

Common Issues:

• No URL validation

• Fetching user-supplied URLs

• No allowlist for external calls

Security Audit Checklist

Code Review

• No hardcoded secrets

• Input validation on all inputs

• Output encoding for XSS prevention

• Parameterized queries for SQL

• Proper error handling

• Authentication on protected routes

• Authorization checks

• Rate limiting on public APIs

Configuration

• Debug mode off

• [ ) HTTPS enforced

• CORS configured correctly

• Security headers set

• Environment variables for secrets

• Database not exposed

Dependencies

• No known vulnerabilities

• Dependencies up to date

• Unused dependencies removed

Scripts

Run security audit:

python scripts/security_audit.py

Check for secrets:

python scripts/find_secrets.py

References

• references/owasp.md - OWASP Top 10 details

• references/checklist.md - Security audit checklist

• references/remediation.md - Vulnerability remediation guide