Security Auditor

# Security Auditor Skill

> Automatic OWASP Top 10 and security vulnerability detection

## Quick Example

```javascript
// You write:
const query = `SELECT * FROM users WHERE id = ${userId}`;

// Skill immediately alerts:
🚨 CRITICAL: SQL injection vulnerability (line 1)
🔧 Fix: const query = 'SELECT * FROM users WHERE id = ?';
📖 https://owasp.org/www-community/attacks/SQL_Injection
```

## What It Detects

- 🚨 SQL Injection
- 🚨 XSS (Cross-Site Scripting)
- 🚨 Exposed Secrets & API Keys
- 🚨 Weak Authentication
- 🚨 Authorization Issues
- ⚠️ Security Misconfigurations
- ⚠️ Insecure Data Storage

## Severity Levels

- 🚨 **CRITICAL**: Exploitable vulnerabilities
- ⚠️ **HIGH**: Security weaknesses
- 📋 **MEDIUM**: Potential issues
- 💡 **LOW**: Best practices

## Integration

- **secret-scanner skill**: Detects exposed credentials
- **@code-reviewer sub-agent**: Deep security audit
- **/review command**: Comprehensive security review

See [SKILL.md](SKILL.md) for full documentation.


---
name: security-auditor
description: Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on file changes. Scans for SQL injection, XSS, secrets exposure, auth issues. Triggers on file changes, security mentions, deployment prep.
allowed-tools: Read, Grep, Bash
---

# Security Auditor Skill

Automatic security vulnerability detection.

## When I Activate

- ✅ Code files modified (especially auth, API, database)
- ✅ User mentions security or vulnerabilities
- ✅ Before deployments or commits
- ✅ Dependency changes
- ✅ Configuration file changes

## What I Scan For

### OWASP Top 10 Patterns

**1. SQL Injection**
```javascript
// CRITICAL: SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;

// SECURE: Parameterized query
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [userId]);
```

**2. XSS (Cross-Site Scripting)**
```javascript
// CRITICAL: XSS vulnerability
element.innerHTML = userInput;

// SECURE: Use textContent or sanitize
element.textContent = userInput;
// or
element.innerHTML = DOMPurify.sanitize(userInput);
```

**3. Authentication Issues**
```javascript
// CRITICAL: Weak JWT secret
const token = jwt.sign(payload, 'secret123');

// SECURE: Strong secret from environment
const token = jwt.sign(payload, process.env.JWT_SECRET);
```

**4. Sensitive Data Exposure**
```python
# CRITICAL: Exposed password
password = "admin123"

# SECURE: Environment variable
password = os.getenv("DB_PASSWORD")
```

**5. Broken Access Control**
```javascript
// CRITICAL: No authorization check
app.delete('/api/users/:id', (req, res) => {
  User.delete(req.params.id);
});

// SECURE: Authorization check
app.delete('/api/users/:id', auth, checkOwnership, (req, res) => {
  User.delete(req.params.id);
});
```

### Additional Security Checks

- **Insecure Deserialization**
- **Security Misconfiguration**
- **Insufficient Logging**
- **CSRF Protection Missing**
- **CORS Misconfiguration**

## Alert Format

```
🚨 CRITICAL: [Vulnerability type]
📍 Location: file.js:42
🔧 Fix: [Specific remediation]
📖 Reference: [OWASP/CWE link]
```

### Severity Levels

- 🚨 **CRITICAL**: Must fix immediately (exploitable vulnerabilities)
- ⚠️ **HIGH**: Should fix soon (security weaknesses)
- 📋 **MEDIUM**: Consider fixing (potential issues)
- 💡 **LOW**: Best practice improvements

## Real-World Examples

### SQL Injection Detection

```javascript
// You write:
app.get('/users', (req, res) => {
  const sql = `SELECT * FROM users WHERE name = '${req.query.name}'`;
  db.query(sql, (err, results) => res.json(results));
});

// I alert:
🚨 CRITICAL: SQL injection vulnerability (line 2)
📍 File: routes/users.js, Line 2
🔧 Fix: Use parameterized queries
  const sql = 'SELECT * FROM users WHERE name = ?';
  db.query(sql, [req.query.name], ...);
📖 https://owasp.org/www-community/attacks/SQL_Injection
```

### Password Storage

```python
# You wr