wehub-resource-sync
1 line
3.1 KiB
JSON
1 line
3.1 KiB
JSON
{"content": "---\nallowed-tools: Read, Bash, Grep, Glob\nargument-hint: [focus-area] | --full\ndescription: Perform comprehensive security assessment and vulnerability analysis\n---\n\n# Security Audit\n\nPerform comprehensive security assessment: $ARGUMENTS\n\n## Current Environment\n\n- Dependency scan: !`npm audit --audit-level=moderate 2>/dev/null || pip check 2>/dev/null || echo \"No package manager detected\"`\n- Environment files: @.env* (if exists)\n- Security config: @.github/workflows/security.yml or @security/ (if exists)\n- Recent commits: !`git log --oneline --grep=\"security\\|fix\" -10`\n\n## Task\n\nPerform systematic security audit following these steps:\n\n1. **Environment Setup**\n - Identify the technology stack and framework\n - Check for existing security tools and configurations\n - Review deployment and infrastructure setup\n\n2. **Dependency Security**\n - Scan all dependencies for known vulnerabilities\n - Check for outdated packages with security issues\n - Review dependency sources and integrity\n - Use appropriate tools: `npm audit`, `pip check`, `cargo audit`, etc.\n\n3. **Authentication & Authorization**\n - Review authentication mechanisms and implementation\n - Check for proper session management\n - Verify authorization controls and access restrictions\n - Examine password policies and storage\n\n4. **Input Validation & Sanitization**\n - Check all user input validation and sanitization\n - Look for SQL injection vulnerabilities\n - Identify potential XSS (Cross-Site Scripting) issues\n - Review file upload security and validation\n\n5. **Data Protection**\n - Identify sensitive data handling practices\n - Check encryption implementation for data at rest and in transit\n - Review data masking and anonymization practices\n - Verify secure communication protocols (HTTPS, TLS)\n\n6. **Secrets Management**\n - Scan for hardcoded secrets, API keys, and passwords\n - Check for proper secrets management practices\n - Review environment variable security\n - Identify exposed configuration files\n\n7. **Error Handling & Logging**\n - Review error messages for information disclosure\n - Check logging practices for security events\n - Verify sensitive data is not logged\n - Assess error handling robustness\n\n8. **Infrastructure Security**\n - Review containerization security (Docker, etc.)\n - Check CI/CD pipeline security\n - Examine cloud configuration and permissions\n - Assess network security configurations\n\n9. **Security Headers & CORS**\n - Check security headers implementation\n - Review CORS configuration\n - Verify CSP (Content Security Policy) settings\n - Examine cookie security attributes\n\n10. **Reporting**\n - Document all findings with severity levels (Critical, High, Medium, Low)\n - Provide specific remediation steps for each issue\n - Include code examples and file references\n - Create an executive summary with key recommendations\n\nUse automated security scanning tools when available and provide manual review for complex security patterns."} |