Security Audit

Performs a comprehensive security scan of the codebase.

Features

• •Dependency Audit: Checks for known vulnerabilities in npm/pnpm dependencies
• •Secret Detection: Scans for accidentally committed secrets (API keys, tokens, passwords)
• •Auth Flow Analysis: Identifies unprotected routes and hardcoded credentials
• •Input Validation: Detects endpoints missing validation and raw req.body usage
• •SAST (Static Analysis): Analyzes code for common security patterns (OWASP Top 10)
• •Container Scanning: Checks Dockerfiles and images for vulnerabilities

Usage

Manual Execution

```bash

Run full audit

./scripts/security-audit.sh

Quick mode (dependencies + secrets only)

./scripts/security-audit.sh --quick

Specific scope

./scripts/security-audit.sh --scope backend

Attempt auto-fix

./scripts/security-audit.sh --fix ```

AI Invocation

When invoked as a skill, the AI will:

1. •Run dependency audit (`npm audit` or `pnpm audit`)
2. •Scan for hardcoded secrets using regex patterns
3. •Check for common OWASP vulnerabilities:
   • •SQL injection patterns
   • •XSS vulnerabilities
   • •Command injection
   • •Path traversal
   • •Insecure deserialization
4. •Analyze authentication patterns
5. •Generate severity-classified report

Checks Performed

1. Dependency Vulnerabilities

```bash

npm

npm audit --json

pnpm

pnpm audit --json ```

Checks against:

• •NPM Advisory Database
• •GitHub Security Advisories
• •Snyk Vulnerability Database (if integrated)

2. Secret Detection

Scans for patterns like:

• •API keys (`api_key`, `apikey`, `API_KEY`)
• •Tokens (`token`, `bearer`, `jwt`)
• •Passwords (`password`, `passwd`, `secret`)
• •AWS credentials (`AKIA`, `aws_secret`)
• •Private keys (`-----BEGIN.*PRIVATE KEY-----`)

Files excluded:

• •`node_modules/`
• •`.env.example`, `.env.template`
• •Test fixtures with known fake values

3. Auth Analysis

Checks for:

• •Routes without authentication middleware
• •Hardcoded credentials in source
• •JWT without expiration
• •Weak password policies

4. Input Validation

Scans for:

• •Direct `req.body` usage without validation
• •Missing sanitization on user input
• •SQL string concatenation
• •Shell command construction with user input

5. OWASP Top 10

Output Format

```markdown

Security Audit Report

Scope: all Date: 2025-01-20T10:30:00Z

Dependency Vulnerabilities

Secret Detection

⚠️ 2 potential secrets found

Auth Analysis

✅ All routes protected

Input Validation

⚠️ 3 issues found

Summary

• •Critical: 0
• •High: 1
• •Medium: 2
• •Low: 4

Recommendations

1. •Update lodash to 4.17.21
2. •Move API key to environment variable
3. •Add input validation middleware ```

Prerequisites

Required

• •Node.js with npm or pnpm

Optional (for deeper analysis)

Integration

CI Pipeline

```yaml security-audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npm ci - run: npm audit --audit-level=high - run: npx gitleaks detect --no-git ```

Pre-commit Hook

```bash

.husky/pre-commit

./scripts/security-audit.sh --quick || { echo "Security issues found. Fix before committing." exit 1 } ```

See Also

• •OWASP Top 10
• •npm audit documentation
• •Audit Framework