Perform security review focusing on common vulnerabilities and OWASP Top 10
Performs security audits with focus on preventing common vulnerabilities.
Invoke this skill when:
# Search for common secret patterns
grep -r "api_key\|apikey\|secret\|password\|token" --include="*.js" --include="*.py" --include="*.go"
# Check for .env files in version control
git log --all --full-history -- "**/.env*"
# Bad
query = f"SELECT * FROM users WHERE id = {user_id}"
# Good
query = "SELECT * FROM users WHERE id = ?"
cursor.execute(query, (user_id,))
// Bad
exec(`convert ${userFilename}`)
// Good
exec('convert', [userFilename])
// Bad
element.innerHTML = userInput
// Good
element.textContent = userInput
// or use framework escaping (React, Vue, etc.)
# Check for vulnerabilities
npm audit
pip-audit
go list -json -m all | nancy sleuth
// Eval usage
eval(userInput)
// Unsafe reflection
eval(`require('${userModule}')`)
// Direct file path from user
fs.readFile(userPath)
// Unsafe deserialization
pickle.loads(user_data)
# Weak random
import random
token = random.randint(1, 1000000) # Use secrets module
# Hash without salt
md5(password) # Use bcrypt/argon2
# Timing attacks
if user_token == expected_token: # Use constant-time compare
Required headers for web apps:
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-XSS-Protection: 1; mode=block
# JavaScript
npm outdated
npm audit fix
# Python
pip list --outdated
pip-audit
# Go
go list -u -m all
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 99
X-RateLimit-Reset: 1623456789
// Be specific, not *
cors({
origin: 'https://yourdomain.com',
credentials: true
})
## Security Review Report
**Date**: YYYY-MM-DD
**Scope**: [what was reviewed]
### Critical Issues
- [Issue] at [location]
- **Risk**: [description]
- **Fix**: [recommendation]
### High Priority
[Same format]
### Medium Priority
[Same format]
### Recommendations
- [General security improvements]
### Summary
- Critical: X
- High: X
- Medium: X
- Low: X
Easy security improvements:
npm audit / pip-audit - Dependency scanningbandit - Python security linterbrakeman - Ruby security scannergosec - Go security checkersemgrep - Multi-language security patternsgit-secrets - Prevent committing secrets