security-audit

Security Audit: Multi-Pass Application Security Review

Structured, multi-pass security audit. Combines automated tooling with manual pattern analysis, maps findings to OWASP Top 10:2025, and produces a prioritized report.

Patterns drawn from real OSS incidents (unauthenticated admin endpoints, credential exfiltration, zip slip, auth bypass whitelists, Trivy supply chain compromise) and OpenSSF/SLSA/OWASP standards.

Target versions (October 2026, release check 2026-10-28):

• Semgrep 1.182.0, Bandit 1.9.4
• Gitleaks 8.30.1, Betterleaks 1.9.0 (same author as Gitleaks), TruffleHog 3.99.7
• Trivy 0.76.1 (0.69.4-0.69.6 was compromised - see known incidents; 0.69.3 is also inside the CVE-2026-63328 range, so stay on 0.72.0+)
• OpenSSF Scorecard 5.6.0 (v6 in proposal stage)
• OWASP Top 10:2025 (released November 2025), OWASP Agentic Top 10:2026 (released December 2025)

Scope: TypeScript/JavaScript (Bun, Node.js, Deno), Python, Go, Rust web applications, CLI tools, Dockerfiles, Compose stacks, CI/CD workflows, Helm charts, Terraform, Proxmox/LXC configs, shell scripts. This skill is SAST + config + supply chain. Not DAST or network pentesting.

When to use

• Security review of application code, services, or self-hosted apps
• Secret scanning, dependency audit, auth review, or OWASP-focused assessment
• Supply chain review for build config, CI/CD, containers, or AI-agent integrations
• Pre-release security gate for a repository or deployment artifact

When NOT to use

• Correctness bugs, logic errors, or race conditions without a security angle - use code-review
• Style, slop, or maintainability cleanup - use code-simplification
• CI/CD pipeline design, runner architecture, or pipeline hardening strategy - use ci-cd
• Offensive testing, privilege escalation, or post-exploitation work - use privilege-escalation
• Novel vulnerability research, fuzzing, patch diffing, or exploit development - use vulnerability-research
• Network appliance administration or firewall tuning - use opnsense-pfsense
• Linux networking setup and troubleshooting - use networking
• Secure construction or hardening of a known domain artifact without repository-wide audit intent
  • use that domain skill. Security-audit owns vulnerability discovery, exploitability, severity, and repository-wide reporting.

---

AI Self-Check

Before returning any security audit report, verify:

• All automated tools attempted: betterleaks/gitleaks/trufflehog, semgrep/bandit, trivy/audit ran (or noted as missing)
• No false positives included: each finding reviewed independently, uncertain items marked "possible false positive"
• Severity classification accurate: follows the report guide table, not inflated for impact (info disclosure is not P0)
• OWASP mapping present: each finding maps to the relevant OWASP Top 10:2025 category
• Remediation is specific: concrete fix per finding, not generic advice ("validate input" is insufficient)
• Commit SHA recorded: report anchored to a specific point in time
• Report kept local: wrote the dated report under docs/local/audits/security-audit/ and verified docs/local/ is gitignored
• Known incidents checked: dependency audit verified against the known supply chain incidents listed in Step 3 (event-stream, ua-parser-js, colors any version, faker, polyfill.io, xz-utils, trivy 0.69.4-0.69.6, TrapDoor, Mini Shai-Hulud worm, outdated lodash), not just CVE databases
• Agentic risks covered (when applicable): MCP servers, AI tool handlers, prompt injection surfaces audited if present
• Scope respected: no external service probing, no DAST, repo-only analysis
• Threat model matched: findings map to the app's actual assets, actors, trust boundaries, and deployment
• Exploitability stated carefully: severity is based on reachable paths and impact, not scanner labels alone
• Cross-cutting agent hygiene applied - see references/agent-hygiene.md

---

Workflow

Run the cheap secret and dependency passes early. In the manual passes, prioritize auth, authorization, input handling, deserialization, and supply-chain paths before low-risk headers.

Step 1: Preflight

1. Detect project language(s) and framework(s) from manifest files (package.json, requirements.txt, go.mod, Cargo.toml, etc.)
2. Check which tools are available (run in parallel, capturing each exit status or the list of missing tools; do not mask failures with ; true):
   • command -v semgrep and command -v bandit (Step 5 static analysis), command -v betterleaks, command -v gitleaks, command -v trufflehog, command -v trivy, command -v scorecard, command -v checkov, plus the ecosystem auditor for Step 3 (pip-audit, govulncheck, cargo-audit)
3. Missing tools: note as "skipped (not installed)" in the report. Don't install without asking. Critical tools (at least one must be available): betterleaks or gitleaks or trufflehog (secret scanning), semgrep (static analysis). If all critical tools are missing, warn that the audit will be manual-only and significantly less thorough.
4. Determine scope: user-specified files > uncommitted changes (offer choice) > full repo.
5. Record current commit SHA for the report.

Step 2: Secret Scanning (Pass 1 - Automated)

Find hardcoded credentials, API keys, tokens, and secrets in code and git history.

Tools (preference order, use whatever's available):

1. betterleaks detect --source . or gitleaks detect --source . --report-format json --report-path /tmp/gitleaks-report.json
2. trufflehog filesystem . --json > /tmp/trufflehog-report.json
3. Fallback: use rg, grep, or equivalent pattern search with references/grep-patterns.md (Secret Scanning Fallback section)

Also check git history for committed-then-removed secrets: git log --all --diff-filter=A -- '*.env*'

What to look for: hardcoded API keys, passwords/tokens in source, .env in git history, base64-encoded creds, private keys, connection strings with embedded passwords, OAuth client secrets.

Step 3: Dependency Audit (Pass 2 - Automated)

Find known CVEs in dependencies and assess supply chain risk.

Tools by ecosystem (pick the one matching the lockfile):

• Bun (bun.lock/bun.lockb): bun audit --audit-level=high (supported levels: low, moderate, high, critical)
• npm (package-lock.json): npm audit --audit-level=high --omit=dev
• pnpm (pnpm-lock.yaml): pnpm audit --audit-level high --prod
• yarn (yarn.lock): yarn npm audit --severity high (Berry) or yarn audit --level high (Classic)
• Python: pip-audit --format json (use safety check --json only when pip-audit is unavailable)
• Go: govulncheck ./...
• Rust: cargo audit --json - also check for unsafe blocks without // SAFETY: comments, transmute misuse, unvalidated FFI boundaries
• General: trivy fs --scanners vuln . (use Trivy 0.76.1 from official releases; never use 0.69.4-0.69.6, and do not roll back to 0.69.3 because CVE-2026-63328 affects every release before 0.72.0)

Flag: reachable HIGH/CRITICAL CVEs whether or not a fix exists, deps unmaintained 2+ years, lockfile out of sync with manifest, non-standard registries. For production applications, prefer exact dependency versions plus a committed, integrity-checked lockfile; ranges alone do not make an install reproducible.

Known supply chain incidents - flag these by name, not just by CVE:

• event-stream 3.3.6 (2018 backdoor targeting bitcoin wallets)
• ua-parser-js 0.7.29/0.8.0/1.0.0 (2021 cryptominer injection)
• colors any version / faker 6.6.6 (2022 maintainer sabotage - the colors package carries ongoing maintainer-sabotage risk regardless of version; prefer chalk or picocolors)
• left-pad (2016 unpublishing incident and trivial dependency fragility; replace the dependency with the platform's built-in padding support)
• lodash <=2.x or any very outdated lodash (prototype pollution chain - high-risk for aged lockfiles; pin to 4.18.0+, the floor that fixes CVE-2026-2950 and CVE-2026-4800)
• polyfill.io (2024 domain takeover, malicious CDN injection)
• xz-utils 5.6.0-5.6.1 (2024 backdoor in compression library)
• TrapDoor (2026-05 multi-registry campaign: 34+ malicious npm/PyPI/crates packages stealing SSH keys and cloud/crypto credentials; notably hides zero-width-Unicode prompt injection in .cursorrules / CLAUDE.md to subvert AI coding agents - check agent rule files, not just dependencies)
• trivy 0.69.4-0.69.6 / aquasecurity/trivy Docker tags 0.69.5-0.69.6 / aquasecurity/trivy-action + aquasecurity/setup-trivy force-pushed tags (2026-03 TeamPCP supply chain compromise - credential-stealing malware in CI/CD pipelines)
• Mini Shai-Hulud worm (2026-04/05 TeamPCP npm/PyPI follow-up: SAP @sap/* npm Apr 29, PyTorch lightning PyPI 2.6.2/2.6.3 Apr 30, 84 malicious versions across 42 @tanstack/* May 11 - self-propagating, steals GitHub/npm tokens, CI/CD secrets, and cloud creds; ~1,800 developers across npm + PyPI) Confirm the affected artifact and execution path before assigning severity. Malicious artifacts with credential theft or equivalent critical exposure warrant P0; historical dependency fragility or an unaffected predecessor version does not. Record maintainer risk separately from demonstrated compromise. For active incident triage, use references/hardening-checklists.md for repo-wide package, IOC, local-runtime, and remote-repo checks.

Scanner security recheck (October 2026, 2026-10-28): CVE-2026-63328 affects Trivy before 0.72.0 when installing an attacker-controlled plugin; it permits writes outside the plugin directory. The 0.76.1 target includes the fix. This is separate from the March supply-chain compromise; only install trusted plugins.

Step 4: Agentic AI & Supply Chain (Pass 3 - Manual)

If the codebase uses LLMs, AI agents, MCP servers, or AI-generated code, check for agentic-specific risks. Based on OWASP Top 10 for Agentic Applications 2026 (released December 2025):

Slopsquatting (AI package hallucination):

• Check for dependencies that don't exist on the registry (AI-hallucinated package names that attackers register). ~20% of AI code samples recommend nonexistent packages, and 43% of hallucinated package names repeat consistently across reruns of the same prompt (Lanyado et al., "We Have a Package for You!", 2024).
• Verify every unfamiliar package name actually exists: npm view <pkg> 2>/dev/null or pip show <pkg>

Agent security patterns:

• ASI01 - Goal Hijack: Can user input redirect agent objectives? Check for unvalidated prompt injection in user-facing AI features.
• ASI02 - Tool Misuse: Are agent tool calls validated? Check for missing input validation on MCP tool handlers, especially file paths and shell commands.
• ASI03 - Privilege Abuse: Do agents inherit overly broad credentials? Check for agents running with admin tokens when read-only would suffice.
• ASI04 - Supply Chain: Are MCP servers and AI plugins from trusted sources? Check for unpinned versions.
• ASI05 - Code Execution: Is AI-generated code executed without review? Check for eval() on LLM output.
• ASI06 - Memory Poisoning: Can external data corrupt RAG/vector databases? Check for unsanitized document ingestion.

MCP server implementation (if present):

• Command injection in tool handlers (43% of MCP vulns)
• Path traversal in file-handling tools
• Missing authentication/authorization
• Excessive tool permissions (principle of least privilege)
• No rate limiting on tool calls
• Elicitation abuse - MCP servers can present interactive dialogs (form fields, browser URLs) to users mid-task. Malicious servers can use this for social engineering (fake "re-authenticate" prompts, credential harvesting). Check that elicitation handlers validate server identity and don't auto-submit sensitive data.

Step 5: Static Analysis (Pass 4 - Automated)

Find code-level vulnerabilities via AST-aware analysis.

Tools:

1. semgrep scan --config auto --json --output /tmp/semgrep-report.json . (or --config p/owasp-top-ten --config p/javascript --config p/typescript)
2. bandit -r src/ -f json (Python only - includes B614 unsafe torch.load() and B615 insecure Hugging Face model downloads since 1.9.x)
3. Check for eslint-plugin-security in devDependencies (JS/TS)

Semgrep catches what linters miss: taint tracking (user input to eval/SQL/shell), SSRF, path traversal, prototype pollution, ReDoS, unsafe deserialization.

Filter: review each finding before including. Discard obvious false positives. Mark uncertain ones as "possible false positive."

Step 6: Authentication & Authorization Review (Pass 5 - Manual)

The #1 OWASP 2025 risk. Automated tools miss most auth bugs. Read the auth implementation and trace every route.

Load grep patterns from references/grep-patterns.md (Auth section).

6.1 Auth middleware coverage:

• Global or per-route? Global is safer (opt-out, not opt-in).
• Route allowlist/bypass list? Review every entry. Watch for substring/prefix matching (startsWith('/api/setup') matches /api/setup-evil) and suffix matching (endsWith('/ping') matches any future route).
• Are new routes automatically protected?

6.2 Credential handling:

• Password hashing: reject SHA-256, MD5, bcrypt cost < 10. Require Argon2id, scrypt, or bcrypt 12+.
• Constant-time comparison for tokens? (crypto.timingSafeEqual, not ===)
• Session token entropy >= 128 bits. Session expiry + cleanup mechanism.

6.3 Privilege escalation:

• Non-admin access to admin endpoints? User IDs from session or client params (IDOR)?
• Can users modify their own role? Last-admin protection? Unauthenticated user creation endpoints?

6.4 Client-controlled state:

• Endpoints trusting client flags (setup_mode, is_admin, skip_auth)?
• Can setup be re-triggered after completion? 2FA setup/disable without existing auth?

6.5 Header trust:

• X-Forwarded-For used for auth decisions? (spoofable without trusted proxy)
• Rate limiting keyed to spoofable header vs connection IP?

Step 7: Injection & Input Validation (Pass 6 - Manual)

Load grep patterns from references/grep-patterns.md (Injection section).

• SQL injection: raw queries with string interpolation, .raw() calls with user input. Remediation is always parameterization, never escaping. Also flag SELECT * in application queries as information-disclosure-adjacent (over-fetching exposes columns added later; use explicit column lists). Flag unhandled callback errors in Node.js database calls (bare err parameter never checked) as a security-adjacent gap (unhandled errors can mask injection attempts or expose stack traces). Concrete forms:
  • node-postgres: db.query('SELECT id, email FROM users WHERE id = $1', [req.params.id])
  • mysql2: db.execute('SELECT id, email FROM users WHERE id = ?', [req.params.id])
  • Prisma: prisma.user.findUnique({ where: { id: req.params.id } }) (tagged-template $queryRaw is safe; $queryRawUnsafe is not)
  • Drizzle: db.select().from(users).where(eq(users.id, req.params.id))
  • Python psycopg: cur.execute('SELECT id FROM users WHERE id = %s', (user_id,)) - never % string-format the SQL
  • Python sqlite3: cur.execute('SELECT id FROM users WHERE id = ?', (user_id,))
• Command injection: shelling out with user args, shell=True with user input, string interpolation in child-process commands
• Path traversal: user paths without containment check, zip extraction without name validation (Zip Slip), recursive delete on user-controlled paths
• SSRF: user URLs passed to HTTP clients, IP allowlist checking hostname string not resolved IP, redirect following to internal hosts, DNS rebinding
• XSS: unsafe HTML rendering with user data, javascript: URLs unblocked
• XML: external entity (XXE) on untrusted input, billion laughs protection

Step 8: Cryptography & Data Protection (Pass 7 - Manual)

Read references/hardening-checklists.md (Cryptography section) and references/grep-patterns.md (Pass 7 section) for search patterns. Covers TLS verification, secrets in logs, error responses, CORS, cookie flags, HSTS, CSP.

Step 9: Container & Infrastructure (Pass 8 - Manual)

Read references/hardening-checklists.md (Container section) and references/grep-patterns.md (Pass 8 section) for search patterns. Covers Dockerfile, Kubernetes, Helm, Terraform, Ansible, Compose hardening.

Step 10: CI/CD & Supply Chain (Pass 9 - Manual)

Read references/hardening-checklists.md (CI/CD section) and references/grep-patterns.md (Pass 9 section) for search patterns. Covers action pinning, GITHUB_TOKEN permissions, OSS governance, OpenSSF Scorecard.

Step 11: Report Generation

Read references/report-guide.md for the severity classification, OWASP mapping table, and report template.

Separate confirmed vulnerabilities, hardening recommendations, and open questions; give each material finding a remediation and a verification step. Protect sensitive findings and reproduction data.

Save to docs/local/audits/security-audit/<YYYY-MM-DD>-<slug>.md. The report contains vulnerability details, so run git check-ignore -q docs/local/audits/security-audit/<file> before writing it. If it fails, offer to add the bare docs/local/ rule, then rerun the check; do not write the report until it passes.

---

What NOT to Flag

These look like security issues but aren't (or are acceptable):

• Intentional TLS skip with opt-in flag and documentation (e.g., self-signed certs in homelab). Flag if global/unconditional.
• CORS: * in development when a production override exists. Flag if no production override.
• Secrets in .env.example with placeholder values (your-key-here). Flag if real values.
• Admin-only endpoints without additional auth when the admin check itself is solid. The issue is bypass, not granularity.
• Rate limiting absence on internal-only services behind a reverse proxy that handles it. Flag if internet-facing.
• eval() in build scripts/tooling that never touches user input. Flag if in request-handling code.
• Test fixtures with fake credentials (test-api-key-12345). Flag if they look real.
• Patch availability is not severity. Rate dependency vulnerabilities by reachable impact even when no fix exists; record the missing fix as remediation status and propose mitigation, isolation, or removal where needed.
• Cookie flags missing on non-auth cookies (analytics, preferences). Only flag on session/auth cookies.
• Terraform state in S3/GCS with proper ACLs. Flag if local state or unencrypted remote state.
• Ansible vault-encrypted files. Flag plaintext secrets, not vault usage.
• privileged: true in CI/build containers that never touch user input. Flag in production/runtime containers.
• Cloud-init with secrets from a vault/secrets-manager. Flag hardcoded secrets in user-data scripts.

---

Reference Files

• references/grep-patterns.md - fallback search patterns for secrets, auth, injection, and config review
• references/hardening-checklists.md - host, container, deployment, and self-hosted app hardening checklists
• references/report-guide.md - reporting format, severity mapping, and OWASP alignment

---

Output Contract

See references/output-contract.md for the full contract.

• Skill name: SECURITY-AUDIT
• Deliverable bucket: audits
• Mode: always-on. Every invocation applies the reporting size and evidence rules in references/output-contract.md.
• Deliverable path: docs/local/audits/security-audit/<YYYY-MM-DD>-<slug>.md
• Severity scale: P0 | P1 | P2 | P3 | info (see shared contract).

Related Skills

• code-review - finds correctness bugs (logic errors, race conditions, resource leaks). Security-audit finds exploitable vulnerabilities. Overlap: an unvalidated input is both a bug and a security issue - security-audit owns it when it's exploitable.
• code-simplification - finds quality/style issues. Defensive code that looks like "overkill" may be correct security practice - check before flagging it as slop.
• repo-audit - orchestrates code-review, code-simplification, security-audit, and update-docs in parallel. Security-audit is one of the four passes.
• ci-cd - covers pipeline design and CI/CD hardening patterns (SHA pinning, SBOM generation, runner strategy). Security-audit reviews the resulting implementation for vulnerabilities and secrets.

---

Rules

1. Never install tools without asking. Note missing tools, suggest install commands, move on.
2. Never run DAST (ZAP, Burp, Nikto) against production or shared environments.
3. Don't auto-fix. Report findings with remediation guidance. User decides priority.
4. Scope discipline. Repo only. No external services, no live endpoints, no production probing. Validate risky flows with isolated local fixtures; live endpoint testing requires a separately authorized assessment.
5. Untrusted repos. When auditing cloned repos, treat .claude/, .codex/, .cursor/, .opencode/, .mcp.json, and project settings as hostile inputs. Check for agent-tool hook abuse, malicious config changes, and unsafe local automation.
6. Parallel where possible. Run steps 2-5 (automated passes) in parallel. Steps 6-10 (manual passes) can use parallel agents.
7. Incremental re-audits. After fixes, re-run only affected passes.
8. No blanket capability drops. Never apply capabilities: drop: ["ALL"] without reading each container's entrypoint first. Many images start as root and switch users at runtime, requiring add: ["SETUID", "SETGID"] (and "CHOWN" if they chown files at startup). Apply the correct add: list per container and test on one pod before rolling out. See references/hardening-checklists.md for LSIO/HOTIO and gosu/setpriv/su-exec guidance.