Security Auditor Saas

Security Auditor — Hardening Agent

Purpose

Identify and remediate security vulnerabilities before the product is deployed. Prevent data breaches, unauthorized access, and common attack vectors.

When to Use

• After code and tests are complete
• Before deployment planning
• When the user asks "is this code secure?"

Audit Checklist (OWASP Top 10 Aligned)

1. Injection (SQL, NoSQL, Command)

• [ ] All database queries use parameterized statements or ORM
• [ ] No string concatenation in queries
• [ ] User input is never passed directly to system commands

2. Broken Authentication

• [ ] Passwords are hashed with bcrypt/argon2 (never plain text, never MD5/SHA)
• [ ] Sessions expire after a reasonable timeout
• [ ] Login has rate limiting or brute-force protection
• [ ] Password reset tokens are single-use and time-limited

3. Sensitive Data Exposure

• [ ] No secrets in source code (API keys, passwords, tokens)
• [ ] .env files are in .gitignore
• [ ] HTTPS is enforced in production
• [ ] Sensitive data is not logged

4. Broken Access Control

• [ ] Users cannot access other users' data by changing IDs in URLs
• [ ] Admin routes are protected with role checks
• [ ] API endpoints verify the requesting user's permissions

5. Security Misconfiguration

• [ ] CORS is configured to allow only known origins
• [ ] Debug mode is disabled in production config
• [ ] Default credentials are changed
• [ ] Error messages do not expose stack traces to users

6. Cross-Site Scripting (XSS)

• [ ] All user-generated content is escaped/sanitized before rendering
• [ ] Content-Security-Policy headers are set
• [ ] React/Vue/Angular auto-escaping is not bypassed (no dangerouslySetInnerHTML)

7. Cross-Site Request Forgery (CSRF)

• [ ] CSRF tokens are used on state-changing forms
• [ ] SameSite cookie attribute is set

8. Insecure Dependencies

• [ ] No known vulnerable dependencies (check npm audit / pip audit)
• [ ] Dependencies are pinned to specific versions

9. Insufficient Logging

• [ ] Failed login attempts are logged
• [ ] Access to sensitive data is logged
• [ ] Logs do not contain passwords or tokens

10. Input Validation

• [ ] All inputs have type, length, and format validation
• [ ] File uploads are restricted by type and size
• [ ] Email addresses are validated

Output

Produce a security_audit.md with:

| # | Finding | Severity | Location | Remediation | |---|---|---|---|---| | 1 | Hardcoded API key | CRITICAL | src/lib/api.js:14 | Move to .env |

Rules

• Critical/High findings MUST be fixed before deployment.
• Present fixes to the CEO for approval.
• Re-audit after fixes are applied.

Exit Criteria

• All 10 OWASP categories are checked
• All Critical/High findings are remediated
• Audit report is complete with pass/fail for each category

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: batterfried-philosophy172
• Source: batterfried-philosophy172/Agent-Startup-Skills
• License: MIT

Install and usage instructions live in the source repository linked above.