From aura-frog
Security agent providing OWASP reference patterns for vulnerability scanning, auth/authorization, secure coding, cryptography, API/mobile/infra security, testing, and compliance. Delegate for security reviews, audits, and best practices.
npx claudepluginhub nguyenthienthanh/aura-frog --plugin aura-frog**Source Agent:** `agents/security.md` **Load:** On-demand when deep security expertise needed --- - Dependency scanning (npm audit, Snyk, OWASP Dependency-Check) - Static code analysis (SonarQube, Semgrep, Bandit) - Dynamic scanning (OWASP ZAP, Burp Suite) - Container scanning (Trivy, Anchore) - Secret scanning (GitGuardian, TruffleHog) - OAuth 2.0 / OpenID Connect implementation review - JWT ...
Runtime security operations agent for dependency scanning, supply chain analysis, secrets detection, OWASP compliance, and incident response. Delegate operational security tasks, excluding code audits and architecture reviews.
Expert security auditor for DevSecOps, vulnerability assessment, threat modeling, OWASP standards, secure authentication (OAuth2/OIDC/JWT), container/Kubernetes security, secrets management, and compliance (GDPR/HIPAA/SOC2). Delegate for audits, pipeline integration, and incident response.
Security auditor specializing in DevSecOps, OWASP Top 10 compliance, vulnerability assessment with CVSS scoring, threat modeling, and remediation plans for apps and infrastructure.
Share bugs, ideas, or general feedback.
Source Agent: agents/security.md
Load: On-demand when deep security expertise needed
Dependency Scanning:
Static Application Security Testing (SAST):
Dynamic Application Security Testing (DAST):
Secret Scanning:
Container Security:
Node.js:
Python:
PHP:
React Native:
AWS:
GCP:
Azure:
Authentication:
Authorization:
Input Validation:
Output Encoding:
Security Headers:
Cryptography:
API Security:
Dependencies:
Logging & Monitoring:
Data Storage:
Network:
Code Protection:
Authentication:
Command: security:audit
Command: security:deps
Command: security:scan
Node.js:
npm install helmet express-rate-limit express-validator
npm install --save-dev @microsoft/eslint-plugin-sdl
npm install --save-dev eslint-plugin-security
Python:
pip install bandit safety
pip install flask-talisman # Security headers for Flask
Container:
# Trivy
brew install trivy
trivy image myimage:latest
Secret Scanning:
# TruffleHog
pip install trufflehog
trufflehog git https://github.com/myorg/myrepo
Vulnerable:
const query = `SELECT * FROM users WHERE id = ${userId}`;
db.query(query);
Secure:
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [userId]);
// Or with Prisma/TypeORM (safe by default)
prisma.user.findUnique({ where: { id: userId } });
Vulnerable:
res.send(`<h1>Hello ${username}</h1>`);
Secure:
import DOMPurify from 'dompurify';
res.send(`<h1>Hello ${DOMPurify.sanitize(username)}</h1>`);
// Or use templating engines with auto-escaping
res.render('hello', { username }); // EJS, Handlebars auto-escape
Vulnerable:
app.post('/transfer', (req, res) => {
// No CSRF protection
transfer(req.body.amount, req.body.to);
});
Secure:
import csrf from 'csurf';
app.use(csrf({ cookie: true }));
app.post('/transfer', (req, res) => {
// CSRF token validated automatically
transfer(req.body.amount, req.body.to);
});
Vulnerable:
import crypto from 'crypto';
const hash = crypto.createHash('md5').update(password).digest('hex');
Secure:
import bcrypt from 'bcrypt';
const hash = await bcrypt.hash(password, 12); // Cost factor 12
const valid = await bcrypt.compare(password, hash);
Vulnerable:
app.get('/user/:id', (req, res) => {
const user = await User.findById(req.params.id);
res.json(user); // No authorization check
});
Secure:
app.get('/user/:id', authenticate, (req, res) => {
if (req.user.id !== req.params.id && !req.user.isAdmin) {
return res.status(403).json({ error: 'Forbidden' });
}
const user = await User.findById(req.params.id);
res.json(user);
});