security-auditor（安全审计员）

Security Auditor

Expert in identifying security vulnerabilities following OWASP Top 10 and security best practices.

When This Skill Activates

Activates when you:

• Request a security audit
• Mention "security" or "vulnerability"
• Need security review
• Ask about OWASP

OWASP Top 10 Coverage

A01: Broken Access Control

Checks:

# Check for missing auth on protected routes
grep -r "@RequireAuth\|@Protected" src/

# Check for IDOR vulnerabilities
grep -r "req.params.id\|req.query.id" src/

# Check for role-based access
grep -r "if.*role.*===" src/

Common Issues:

• Missing authentication on sensitive endpoints
• IDOR: Users can access other users' data
• Missing authorization checks
• API keys in URL

A02: Cryptographic Failures

Checks:

# Check for hardcoded secrets
grep -ri "password.*=.*['\"]" src/
grep -ri "api_key.*=.*['\"]" src/
grep -ri "secret.*=.*['\"]" src/

# Check for weak hashing
grep -r "md5\|sha1" src/

# Check for http URLs
grep -r "http:\/\/" src/

Common Issues:

• Hardcoded credentials
• Weak hashing algorithms (MD5, SHA1)
• Unencrypted sensitive data
• HTTP instead of HTTPS

A03: Injection

Checks:

# SQL injection patterns
grep -r "\".*SELECT.*+.*\"" src/
grep -r "\".*UPDATE.*SET.*+.*\"" src/

# Command injection
grep -r "exec(\|system(\|spawn(" src/
grep -r "child_process.exec" src/

# Template injection
grep -r "render.*req\." src/

Common Issues:

• SQL injection
• NoSQL injection
• Command injection
• XSS (Cross-Site Scripting)
• Template injection

A04: Insecure Design

Checks:

# Check for rate limiting
grep -r "rateLimit\|rate-limit\|throttle" src/

# Check for 2FA
grep -r "twoFactor\|2fa\|mfa" src/

# Check for session timeout
grep -r "maxAge\|expires\|timeout" src/

Common Issues:

• No rate limiting on auth endpoints
• Missing 2FA for sensitive operations
• Session timeout too long
• No account lockout after failed attempts

A05: Security Misconfiguration

Checks:

# Check for debug mode
grep -r "DEBUG.*=.*True\|debug.*=.*true" src/

# Check for CORS configuration
grep -r "origin.*\*" src/

# Check for error messages
grep -r "console\.log.*error\|console\.error" src/

Common Issues:

• Debug mode enabled in production
• Overly permissive CORS
• Verbose error messages
• Default credentials not changed

A06: Vulnerable Components

Checks:

# Check package files
cat package.json | grep -E "\"dependencies\"|\"devDependencies\""
cat requirements.txt
cat go.mod

# Run vulnerability scanner
npm audit
pip-audit

Common Issues:

• Outdated dependencies
• Known vulnerabilities in dependencies
• Unused dependencies
• Unmaintained packages

A07: Authentication Failures

Checks:

# Check password hashing
grep -r "bcrypt\|argon2\|scrypt" src/

# Check password requirements
grep -r "password.*length\|password.*complex" src/

# Check for password in URL
grep -r "password.*req\." src/

Common Issues:

• Weak password hashing
• No password complexity requirements
• Password in URL
• Session fixation

A08: Software/Data Integrity

Checks:

# Check for subresource integrity
grep -r "integrity\|crossorigin" src/

# Check for signature verification
grep -r "verify.*signature\|validate.*token" src/

Common Issues:

• No integrity checks
• Unsigned updates
• Unverified dependencies

A09: Logging Failures

Checks:

# Check for sensitive data in logs
grep -r "log.*password\|log.*token\|log.*secret" src/

# Check for audit trail
grep -r "audit\|activity.*log" src/

Common Issues:

• Sensitive data in logs
• No audit trail for critical operations
• Logs not protected
• No log tampering detection

A10: SSRF (Server-Side Request Forgery)

Checks:

# Check for arbitrary URL fetching
grep -r "fetch(\|axios(\|request(\|http\\.get" src/

# Check for webhook URLs
grep -r "webhook.*url\|callback.*url" src/

Common Issues:

• No URL validation
• Fetching user-supplied URLs
• No allowlist for external calls

Security Audit Checklist

Code Review

• No hardcoded secrets
• Input validation on all inputs
• Output encoding for XSS prevention
• Parameterized queries for SQL
• Proper error handling
• Authentication on protected routes
• Authorization checks
• Rate limiting on public APIs

Configuration

• Debug mode off
• [) HTTPS enforced
• CORS configured correctly
• Security headers set
• Environment variables for secrets
• Database not exposed

Dependencies

• No known vulnerabilities
• Dependencies up to date
• Unused dependencies removed

Scripts

Run security audit:

python scripts/security_audit.py

Check for secrets:

python scripts/find_secrets.py

References

• references/owasp.md - OWASP Top 10 details
• references/checklist.md - Security audit checklist
• references/remediation.md - Vulnerability remediation guide