# Audit Security

> Scan the codebase for code-level security vulnerabilities including hardcoded secrets, injection risks, missing auth checks, and insecure patterns, then produce a prioritized remediation plan.

- **Type:** Skill
- **Install:** `agentstack add skill-tomzx-agents-audit-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [tomzx](https://agentstack.voostack.com/s/tomzx)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [tomzx](https://github.com/tomzx)
- **Source:** https://github.com/tomzx/agents/tree/main/skills/audit-security

## Install

```sh
agentstack add skill-tomzx-agents-audit-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

TODAY=!`date +%Y-%m-%d`

# Security Audit

Scans your own code for vulnerabilities — distinct from `/audit-dependencies` which covers external packages. Covers hardcoded secrets, injection patterns, missing authentication and authorization checks, insecure defaults, and other OWASP-class issues. Produces a prioritized remediation plan with severity ratings.

## Prerequisites

- Working directory is the root of the repository
- Optional: `$1` — path to limit the scan (defaults to `.`)
- Language-specific tools (degrades to grep heuristics if unavailable):
  - Any language: `semgrep` (`pip install semgrep` or `brew install semgrep`)
  - Secrets: `trufflehog` (`pip install trufflehog`) or `gitleaks` (`brew install gitleaks`)
  - Python: `bandit` (`uv tool install bandit`)
  - JavaScript/TypeScript: `eslint` with `eslint-plugin-security`
  - Go: `gosec` (`go install github.com/securego/gosec/v2/cmd/gosec@latest`)

## Vulnerability Categories

| Category | Severity | Examples |
|----------|----------|---------|
| Hardcoded secrets | 🔴 Critical | API keys, passwords, tokens in source |
| Injection | 🔴 Critical | SQL, command, LDAP, XPath injection |
| Insecure deserialization | 🔴 Critical | `pickle.loads`, `eval`, `exec` on user input |
| Broken authentication | 🔴 High | Missing auth checks, weak session handling |
| Sensitive data exposure | 🔴 High | PII/secrets logged, transmitted unencrypted |
| Insecure direct object reference | 🟡 High | Missing ownership checks on resource access |
| Security misconfiguration | 🟡 Medium | Debug mode on, permissive CORS, weak TLS |
| Missing authorization | 🟡 Medium | Authenticated but not authorized |
| Cryptography issues | 🟡 Medium | Weak algorithms (MD5, SHA1), hardcoded IVs |
| Dependency confusion | 🟢 Low | Internal package names resolvable publicly |

## Steps

### 1. Detect Language and Available Tools

```
find ${1:-.} -type f | sed 's/.*\.//' | sort | uniq -c | sort -rn | head -10
command -v semgrep && semgrep --version
command -v bandit && bandit --version
command -v gosec && gosec --version
command -v gitleaks && gitleaks version
command -v trufflehog && trufflehog --version
```

### 2. Scan for Hardcoded Secrets

**gitleaks (preferred — scans git history too):**
```
gitleaks detect --source ${1:-.} --report-format json --report-path .gitleaks-report.json 2>/dev/null
cat .gitleaks-report.json 2>/dev/null | python3 -c "import json,sys; [print(f['RuleID'], f['File'], f['StartLine']) for f in json.load(sys.stdin)]" 2>/dev/null
```

**trufflehog:**
```
trufflehog filesystem ${1:-.} --json 2>/dev/null | head -50
```

**grep fallback:**
```
grep -rn --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.env*" \
  -iE "(password|secret|api_key|apikey|token|private_key)\s*=\s*['\"][^'\"]{8,}" \
  ${1:-.} | grep -v "test\|spec\|mock\|example\|placeholder\|your_" | head -30
```

Also check for secrets accidentally committed in config files:
```
grep -rn --include="*.yaml" --include="*.yml" --include="*.json" --include="*.toml" \
  -iE "(password|secret|token|key)\s*:\s*['\"]?[A-Za-z0-9+/]{16,}" \
  ${1:-.} | grep -v "test\|example\|template" | head -20
```

### 3. Run Language-Specific Scanners

**Python — bandit:**
```
bandit -r ${1:-.} -f json -o .bandit-report.json 2>/dev/null
bandit -r ${1:-.} -ll 2>/dev/null | tail -40
```

**JavaScript/TypeScript — semgrep with security ruleset:**
```
semgrep --config=p/javascript --config=p/typescript --json --output .semgrep-report.json ${1:-.} 2>/dev/null
```

**Go — gosec:**
```
gosec -fmt=json -out=.gosec-report.json ./... 2>/dev/null
gosec -severity medium ./... 2>/dev/null | tail -40
```

**Any language — semgrep OWASP ruleset:**
```
semgrep --config=p/owasp-top-ten --config=p/secrets --json --output .semgrep-owasp.json ${1:-.} 2>/dev/null
```

### 4. Check for Injection Vulnerabilities

**SQL injection:**
```
grep -rn --include="*.py" --include="*.js" --include="*.ts" --include="*.go" \
  -E '(execute|query|cursor\.execute|db\.query)\s*\(\s*[f"'"'"']|\.format\s*\(' \
  ${1:-.} | grep -i "select\|insert\|update\|delete\|where" | head -20
```

**Command injection:**
```
grep -rn --include="*.py" --include="*.js" --include="*.ts" \
  -E "(os\.system|subprocess\.(call|run|Popen)|exec\(|eval\(|child_process)" \
  ${1:-.} | grep -v "shell=False\|#" | head -20
```

**Insecure deserialization:**
```
grep -rn --include="*.py" \
  -E "(pickle\.loads|yaml\.load\s*\([^,)]+\)|eval\s*\(|exec\s*\()" \
  ${1:-.} | grep -v "yaml\.safe_load\|#" | head -20
```

### 5. Check Authentication and Authorization

Find route/endpoint definitions and check for missing auth decorators:

**Python (Flask/FastAPI):**
```
grep -rn --include="*.py" -B2 \
  -E "@(app|router)\.(get|post|put|delete|patch)\(" \
  ${1:-.} | grep -v "login_required\|current_user\|Depends\|authenticate\|#" | head -30
```

**Express (JavaScript):**
```
grep -rn --include="*.js" --include="*.ts" -B3 \
  -E "router\.(get|post|put|delete|patch)\(" \
  ${1:-.} | grep -v "auth\|middleware\|protect\|verify\|#" | head -30
```

### 6. Check for Sensitive Data in Logs

```
grep -rn --include="*.py" --include="*.js" --include="*.ts" --include="*.go" \
  -iE "(log|logger|print|console\.log)\s*\(.*?(password|token|secret|credit_card|ssn|api_key)" \
  ${1:-.} | grep -v "test\|spec\|#" | head -20
```

### 7. Check Cryptography

```
grep -rn --include="*.py" --include="*.js" --include="*.ts" \
  -iE "(md5|sha1|des\b|rc4|random\(\)|Math\.random)" \
  ${1:-.} | grep -v "test\|comment\|#\|//" | head -20
```

### 8. Check Security Configuration

```
# Debug mode enabled
grep -rn --include="*.py" --include="*.js" --include="*.ts" \
  -E "DEBUG\s*=\s*True|debug\s*:\s*true" ${1:-.} | grep -v "test\|spec" | head -10

# Permissive CORS
grep -rn --include="*.py" --include="*.js" --include="*.ts" \
  -iE "allow_origins\s*=\s*\[?\s*['\"]?\*|cors\s*\(\s*\{.*origin.*\*" \
  ${1:-.} | head -10

# SSL verification disabled
grep -rn --include="*.py" \
  -E "verify\s*=\s*False|ssl_verify\s*=\s*False" \
  ${1:-.} | grep -v "test\|#" | head -10
```

### 9. Deduplicate and Prioritize

Filter false positives:
- Exclude test files, fixtures, and example configs unless they contain real credentials
- Exclude findings suppressed with `# nosec`, `// eslint-disable`, or equivalent
- Confirm injection findings are actually reachable with user-controlled input

Rank by severity using CVSS-inspired categories: Critical > High > Medium > Low.

### 10. Print the Report

```
# Security Audit — {TODAY}

## Summary

- Files scanned: N
- 🔴 Critical findings: N
- 🔴 High findings: N
- 🟡 Medium findings: N
- 🟢 Low findings: N
- Tools used: 

## Critical & High Findings

### 1. Hardcoded Secret — `:`
**Severity:** Critical
**Finding:** API key for  hardcoded in source
**Risk:** Anyone with read access to the repo can use this credential
**Fix:** Move to environment variable; rotate the exposed key immediately

### 2. SQL Injection — `:`
…

## Medium Findings

…

## Recommended Remediation Order

1. Rotate any exposed secrets immediately (before any code changes)
2. Fix injection vulnerabilities
3. Add missing auth checks
4. Address cryptography issues
5. Fix configuration issues

## False Positives Excluded

- ``: 
```

## Example Usage

**Scenario 1: Routine quarterly scan**
```
/audit-security
```
Finds 2 hardcoded API keys in a config file committed two years ago, 1 SQL injection in a legacy query, and permissive CORS on a staging endpoint. Recommends rotating keys immediately and parameterizing the query.

**Scenario 2: Pre-release gate**
```
/audit-security src/api
```
Scans only the API layer before a public launch. Finds 3 endpoints missing authorization checks.

## Useful Commands Reference

| Command | Description |
|---------|-------------|
| `bandit -r . -ll` | Python security scan, medium severity and above |
| `semgrep --config=p/owasp-top-ten .` | OWASP Top 10 scan (any language) |
| `semgrep --config=p/secrets .` | Secret detection via semgrep |
| `gosec ./...` | Go security scan |
| `gitleaks detect --source .` | Secret scan including git history |
| `trufflehog filesystem .` | High-signal secret detection |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [tomzx](https://github.com/tomzx)
- **Source:** [tomzx/agents](https://github.com/tomzx/agents)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** yes
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-tomzx-agents-audit-security
- Seller: https://agentstack.voostack.com/s/tomzx
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.