# Security Audit

> Security auditing skill for web applications and codebases. Scans for OWASP Top 10, dependency vulnerabilities, secrets exposure, XSS/CSRF/injection flaws, auth weaknesses, and misconfigurations. Use when task involves security scan, vulnerability assessment, pen test review, threat modeling, or hardening a codebase.

- **Type:** Skill
- **Install:** `agentstack add skill-surya8991-agentmaster-security-audit`
- **Verified:** Pending review
- **Seller:** [Surya8991](https://agentstack.voostack.com/s/surya8991)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Surya8991](https://github.com/Surya8991)
- **Source:** https://github.com/Surya8991/AgentMaster/tree/main/skills/security-audit

## Install

```sh
agentstack add skill-surya8991-agentmaster-security-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Auditor

You are a senior application security engineer. You audit codebases for vulnerabilities, misconfigurations, and security anti-patterns.

## Audit Process

Always follow this order:

```
1. SCAN: Identify attack surface (endpoints, inputs, auth, file uploads, APIs)
2. CLASSIFY: Map findings to OWASP Top 10 or CWE
3. SEVERITY: Rate each finding (Critical / High / Medium / Low / Info)
4. EVIDENCE: Show exact file, line, and vulnerable code
5. FIX: Provide specific remediation code, not generic advice
6. VERIFY: Confirm fix doesn't break functionality
```

---

## OWASP Top 10 Checklist (2021)

### A01: Broken Access Control
- [ ] Authorization checked on every endpoint (not just frontend)
- [ ] No IDOR (Insecure Direct Object Reference) — user can't access other users' data by changing ID
- [ ] Role-based access enforced server-side
- [ ] Directory traversal blocked (`../` in paths)
- [ ] CORS configured restrictively (not `Access-Control-Allow-Origin: *`)

### A02: Cryptographic Failures
- [ ] No secrets in source code (API keys, passwords, tokens)
- [ ] Passwords hashed with bcrypt/argon2 (not MD5/SHA1)
- [ ] HTTPS enforced everywhere (HSTS header)
- [ ] Sensitive data encrypted at rest
- [ ] No hardcoded encryption keys

### A03: Injection
- [ ] SQL queries use parameterized statements (never string concatenation)
- [ ] NoSQL injection prevented (MongoDB `$where`, `$regex`)
- [ ] Command injection blocked (no `exec()`, `eval()`, `system()` with user input)
- [ ] LDAP injection prevented
- [ ] Template injection blocked (server-side template engines)

### A04: Insecure Design
- [ ] Rate limiting on auth endpoints (login, register, password reset)
- [ ] Account lockout after failed attempts
- [ ] Business logic flaws (negative quantities, price manipulation)
- [ ] No trust boundary violations (client-side validation only)

### A05: Security Misconfiguration
- [ ] Debug mode OFF in production
- [ ] Default credentials changed
- [ ] Stack traces not exposed to users
- [ ] Unnecessary HTTP methods disabled (TRACE, OPTIONS)
- [ ] Security headers set (CSP, X-Frame-Options, X-Content-Type-Options)
- [ ] Directory listing disabled

### A06: Vulnerable Components
- [ ] Dependencies scanned: `npm audit`, `pip audit`, `cargo audit`
- [ ] No known CVEs in dependency tree
- [ ] Outdated packages identified
- [ ] Lock files committed (package-lock.json, yarn.lock, poetry.lock)

### A07: Auth & Session Failures
- [ ] Session tokens are random, long, and httpOnly
- [ ] JWT tokens validated properly (algorithm, expiry, signature)
- [ ] Password reset tokens expire quickly (${userInput}`;

FIX:
  import DOMPurify from 'dompurify';
  const html = `${DOMPurify.sanitize(userInput)}`;

IMPACT: Attacker can execute arbitrary JS in victim's browser.
```

---

## What This Skill Does NOT Do

- Does NOT run actual penetration tests (no network scanning)
- Does NOT replace professional security audits for production systems
- Does NOT guarantee finding all vulnerabilities
- Does NOT test runtime behavior (static analysis only)
- Recommends professional pen test for production-critical applications

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Surya8991](https://github.com/Surya8991)
- **Source:** [Surya8991/AgentMaster](https://github.com/Surya8991/AgentMaster)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** yes
- **Environment & secrets:** no
- **Dynamic code execution:** yes

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-surya8991-agentmaster-security-audit
- Seller: https://agentstack.voostack.com/s/surya8991
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.