nixos-config/home/common/programs/claude/skills/security-scan/SKILL.md

description

description
Comprehensive security scan and vulnerability assessment (OWASP, SAST, dependencies, secrets)

Security Scan and Vulnerability Assessment

You are a security expert. Perform a comprehensive security audit to identify vulnerabilities, provide remediation guidance, and implement security best practices.

Requirements

$ARGUMENTS

Process

1. Detect Project Type

Scan the project to identify technologies:

• Python (requirements.txt, setup.py, pyproject.toml)
• JavaScript/Node.js (package.json)
• Go (go.mod)
• Rust (Cargo.toml)
• Docker (Dockerfile)
• Terraform (*.tf)

2. Code Vulnerability Scan (SAST)

Search the codebase for these vulnerability patterns:

CRITICAL:

• SQL Injection: raw queries with string concatenation/interpolation
• Hardcoded Secrets: API keys, passwords, tokens in source code
• Code Evaluation: eval(), exec(), Function() usage

HIGH:

• XSS: innerHTML, dangerouslySetInnerHTML, document.write with user input
• Path Traversal: unsanitized file path operations
• CSRF: disabled CSRF protection
• CORS: wildcard origin configuration

MEDIUM:

• Insecure Random: Math.random(), rand() for security-sensitive operations
• Debug Mode: debug=True in production configs
• Missing Security Headers: no helmet() or equivalent

3. Dependency Vulnerability Scan

Check for known vulnerabilities in dependencies:

• npm: npm audit --json
• pip: pip-audit or safety check
• cargo: cargo audit
• go: govulncheck

4. Secret Detection

Search for leaked secrets:

• API keys and tokens
• Database connection strings
• Private keys
• AWS/GCP/Azure credentials
• Passwords in config files

Use patterns:

grep -rn "(?i)(api[_-]?key|apikey|secret|password|token)\s*[:=]\s*[\"'][^\"']{8,}"
grep -rn "(?i)bearer\s+[a-zA-Z0-9\-\._~\+\/]{20,}"
grep -rn "(?i)(aws[_-]?access|aws[_-]?secret)\s*[:=]"

5. Framework-Specific Checks

React/Next.js:

• dangerouslySetInnerHTML usage
• eval() in components
• Exposed API routes without auth

Django:

• @csrf_exempt decorators
• Raw SQL queries
• DEBUG = True

Express:

• Missing helmet middleware
• Wildcard CORS
• No rate limiting

6. Generate Report

# Security Scan Report

**Date**: <date>
**Project**: <project-name>
**Risk Score**: <0-100>

## Summary
- Critical: N findings
- High: N findings
- Medium: N findings
- Low: N findings

## Findings

### [Finding Title]
- **Severity**: CRITICAL|HIGH|MEDIUM|LOW
- **Category**: SAST|Dependencies|Secrets|Config
- **File**: path/to/file:line
- **CWE**: CWE-XXX
- **Description**: What was found
- **Remediation**: How to fix it

## Dependency Vulnerabilities
<List of vulnerable packages with CVEs>

## Recommendations
1. Immediate actions (Critical/High)
2. Short-term improvements (Medium)
3. Long-term hardening (Low)