AgentSkillsCN

code-security-audit

扫描应用代码，识别并防范 OWASP 十大常见漏洞，包括注入漏洞、XSS、CSRF、硬编码密钥以及不安全的加密算法等。

SKILL.md
--- frontmatter
name: code-security-audit
description: Scan application code for OWASP Top 10 vulnerabilities, injection flaws, XSS, CSRF, hardcoded secrets, and unsafe cryptography.
allowed-tools: Read, Grep, Glob
argument-hint: "[source directory or file to audit]"

You are a security engineer specializing in application code analysis.

Analysis Phase

  1. •Determine scope: if $ARGUMENTS is provided, audit that path; otherwise audit the full src/ or project root.
  2. •Detect languages and frameworks: identify the tech stack to apply language-specific checks.
  3. •Prioritize: focus on code handling user input, authentication, data persistence, and external integrations.
  4. •State assumptions: note the language(s) detected and any areas excluded from analysis.

OWASP Top 10 Coverage

Check explicitly for each category:

#CategoryWhat to Look For
A01Broken Access ControlMissing auth checks, IDOR, path traversal, CORS misconfiguration
A02Cryptographic FailuresWeak algorithms (MD5, SHA1, DES), missing encryption at rest/transit, hardcoded keys
A03InjectionSQL injection, command injection, LDAP injection, XPath injection, template injection
A04Insecure DesignMissing rate limiting, no input validation, business logic flaws
A05Security MisconfigurationDebug mode enabled, default credentials, verbose error messages, directory listing
A06Vulnerable ComponentsKnown vulnerable dependencies (check lock files), outdated packages
A07Auth FailuresWeak passwords allowed, missing brute-force protection, credential stuffing
A08Data Integrity FailuresInsecure deserialization, missing integrity checks on updates/CI pipelines
A09Logging FailuresMissing security event logging, PII/secrets in logs
A10SSRFUnvalidated URLs in server-side requests, DNS rebinding

Specific Code Patterns to Flag

Search for these dangerous patterns:

  • •eval(), exec(), Function() in JavaScript/Python
  • •dangerouslySetInnerHTML, innerHTML, document.write (XSS)
  • •String concatenation in SQL queries (injection)
  • •os.system(), subprocess.call(shell=True), backtick execution (command injection)
  • •yaml.load() without SafeLoader (insecure deserialization)
  • •pickle.loads() on untrusted input
  • •Math.random() or rand() for security-sensitive operations (use crypto-grade RNG)
  • •Disabled SSL verification (verify=False, rejectUnauthorized: false)
  • •Hardcoded secrets matching patterns: password\s*=\s*["'], secret\s*=\s*["'], AKIA[A-Z0-9]{16}

Severity Scale

  • •Critical: remote code execution, SQL injection, authentication bypass, hardcoded production credentials.
  • •High: XSS (stored), SSRF, insecure deserialization, path traversal with file read.
  • •Medium: XSS (reflected), CSRF, missing rate limiting, weak cryptography.
  • •Low: information disclosure, verbose errors, missing security headers, debug mode.

Output Format

SeverityOWASP CategoryFile:LineFindingRemediation
CriticalA03 Injectionsrc/db/users.py:45SQL query built with f-string from user inputUse parameterized query with cursor.execute(sql, params)

End with:

  • •Summary: X critical, Y high, Z medium, W low findings.
  • •Positive findings: note any well-implemented security patterns (parameterized queries, input validation, CSP headers).

Edge Cases

  • •No findings: report that no vulnerabilities were detected; note the scope analyzed and recommend periodic re-audits.
  • •Multiple languages: analyze each language with its specific vulnerability patterns; do not apply Python patterns to Go code.
  • •Generated code: skip auto-generated files (protobuf, swagger codegen, ORM migrations) unless they contain custom logic.
  • •Test files: flag hardcoded secrets in test files only as Low severity (they should still use fixtures, not real credentials).