Security Analysis Skill

Quick Reference

Use this skill when:

• •Reviewing code for security vulnerabilities
• •Implementing authentication/authorization
• •Validating input handling
• •Checking for common security flaws
• •Ensuring OWASP Top 10 compliance

Security Checklist (OWASP Top 10)

1. Broken Access Control

Check for:

• •Missing authorization checks on protected routes
• •Insecure direct object references (IDOR)
• •Privilege escalation vulnerabilities

Pattern:

# Find routes without auth middleware - adjust pattern for your framework
grep -rn "router\.\(get\|post\|put\|delete\|patch\)" src/routes/ | \
  grep -v "requireAuth\|isAuthenticated\|checkPermission" | \
  grep -v "public"

2. Cryptographic Failures

Check for:

• •Passwords stored in plain text
• •Weak hashing algorithms (MD5, SHA1)
• •Hardcoded secrets or API keys
• •Insufficient bcrypt rounds (<10)

Patterns to Scan:

# Find weak crypto usage
grep -rn "md5\|sha1\|createHash('sha1')" src/

# Find hardcoded secrets
grep -rn "api[_-]?key\s*=\s*['\"][a-zA-Z0-9]" src/

# Find potential password issues
grep -rn "password\s*=\s*['\"]" src/

3. Injection Vulnerabilities

Check for:

• •SQL injection (unparameterized queries)
• •NoSQL injection (unvalidated queries)
• •Command injection (shell commands with user input)
• •XSS (unescaped user content)

Patterns to Scan:

# Find potential SQL injection (template literals in queries)
grep -rn "query.*\${" src/

# Find command execution
grep -rn "exec\|spawn\|execSync" src/

# Find eval usage
grep -rn "eval(" src/

4. Insecure Design

Check for:

• •Missing rate limiting on sensitive endpoints
• •No CSRF protection
• •Insecure session management
• •Missing security headers

5. Security Misconfiguration

Check for:

• •Debug mode enabled in production
• •Default credentials
• •Verbose error messages exposing internals

Patterns to Scan:

# Find debug code
grep -rn "console\.log\|debugger" src/

# Find exposed secrets in errors
grep -rn "throw.*password\|throw.*token\|throw.*secret" src/

6. Vulnerable Components

Check for:

• •Outdated packages with known vulnerabilities

Scan Commands:

# NPM
npm audit --audit-level=moderate

# PNPM
pnpm audit --audit-level=moderate

# Yarn
yarn audit --level moderate

7. Authentication Failures

Check for:

• •Weak password requirements
• •Session fixation vulnerabilities
• •Insufficient session timeout

8. Data Integrity Failures

Check for:

• •Unsigned/unverified packages
• •No integrity checks on uploaded files
• •Insecure deserialization

9. Logging Failures

Check for:

• •No audit logging for sensitive operations
• •Logging sensitive data (passwords, tokens)

10. SSRF Vulnerabilities

Check for:

• •Unvalidated URL fetching
• •Internal network access from user input
• •Open redirects

Automated Security Scan

Create a security scan script appropriate for your project:

#!/bin/bash
echo "Running Security Scan..."

# 1. Check dependencies
echo "1. Checking dependencies..."
npm audit --audit-level=moderate 2>/dev/null || \
  pnpm audit --audit-level=moderate 2>/dev/null || \
  yarn audit --level moderate 2>/dev/null

# 2. Find hardcoded secrets
echo "2. Scanning for hardcoded secrets..."
grep -rn "password\s*=\s*['\"]" src/ --exclude-dir=node_modules || echo "No hardcoded passwords found"

# 3. Find weak crypto
echo "3. Checking for weak cryptography..."
grep -rn "md5\|sha1" src/ --exclude-dir=node_modules || echo "No weak crypto found"

# 4. Find SQL injection risks
echo "4. Checking for SQL injection risks..."
grep -rn "query.*\${" src/ --exclude-dir=node_modules || echo "No obvious injection risks"

# 5. Check for eval
echo "5. Checking for eval usage..."
grep -rn "eval(" src/ --exclude-dir=node_modules || echo "No eval usage found"

echo "Security scan complete"

Secure Code Patterns

Input Validation

Always validate and sanitize user input:

• •Use schema validation (Zod, Yup, Joi)
• •Escape HTML for display
• •Parameterize database queries

Authentication

• •Hash passwords with bcrypt (12+ rounds)
• •Use secure session configuration (httpOnly, secure, sameSite)
• •Implement rate limiting on auth endpoints

Authorization

• •Check permissions on every protected endpoint
• •Use principle of least privilege
• •Log access attempts

Error Handling

• •Never expose stack traces in production
• •Log errors with context but without secrets
• •Return generic error messages to users

Key Principles

1. •Trust nothing from users - Validate all input
2. •Defense in depth - Multiple security layers
3. •Least privilege - Minimal permissions
4. •Audit everything - Log security events
5. •Keep updated - Regular dependency audits
6. •HTTPS everywhere - Encrypt in transit
7. •Hash, don't encrypt passwords - Use bcrypt