Security audit (OWASP Top 10, secrets, vulnerabilities)
Performs comprehensive security audits checking for OWASP Top 10 vulnerabilities, hardcoded secrets, and weak configurations. Use it to scan your entire codebase or specific files before deployment or during security reviews.
/plugin marketplace add cameronsjo/claude-marketplace/plugin install security@cameronsjofile or directoryComprehensive security audit covering OWASP Top 10, AI/MCP security, and secrets management.
Review entire codebase:
/security-review
Review specific file:
/security-review src/auth/login.ts
Review directory:
/security-review src/api/
This command uses the security-review skill to conduct thorough security audits.
Invoke the skill for comprehensive security analysis:
Use the security-review skill to conduct a security audit.
Collect information about the application:
Questions to ask (if not obvious from code):
Auto-detect from codebase:
.env, config filesDetermine what to review:
If path provided:
File types to scan:
.js, .ts, .py, .go, .java, .cs, .rb.env, .yaml, .json, config.*Dockerfile, docker-compose.yml, *.tfpackage.json, requirements.txt, go.modSystematically check each OWASP Top 10 category:
Check for:
Search patterns:
# Authorization decorators/middleware
@require_auth, @authorize, check_permission, verify_access
# JWT handling
jwt.decode, jwt.verify, validateToken
# Rate limiting
@rate_limit, throttle, rateLimit
Report:
Check for:
Search patterns:
# Hardcoded secrets
password\s*=\s*["'], api[_-]?key\s*=\s*["'], secret\s*=\s*["']
# Weak crypto
MD5, SHA1, DES, RC4
# Key management
process.env, os.environ, hardcoded keys
Run secrets scanner:
# If scripts exist
python ~/.claude/skills/security-review/scripts/find-secrets.py .
Report:
Check for:
Search patterns:
# SQL injection risks
raw SQL queries, string concatenation in queries
execute("SELECT * FROM users WHERE id=" + user_input)
# Command injection
subprocess.call, exec, eval, os.system
child_process.exec, shell=True
# NoSQL injection
MongoDB find/update with unvalidated input
Report:
Check for:
Analyze:
Check for:
Search patterns:
# Default creds
admin/admin, root/root, test/test
# Debug mode
DEBUG=True, NODE_ENV=development in production
# Verbose errors
stack traces, detailed error messages in responses
Report:
Check dependencies:
# Node.js
npm audit
# Python
pip-audit
# or
safety check
# Go
go list -json -m all | nancy sleuth
# Ruby
bundle audit
Report:
Check for:
Search patterns:
# Password handling
bcrypt, argon2, PBKDF2 (good)
plain text passwords, MD5 passwords (bad)
# Session management
session timeout, secure cookies, httpOnly flags
Report:
Check for:
Search patterns:
# Deserialization
pickle.loads, eval, exec
JSON.parse on untrusted data
Check for:
Search patterns:
# Logging
logger, console.log, print statements
Check: Are auth failures logged?
Check: Are access attempts logged?
Report:
Check for:
Search patterns:
# HTTP requests with user input
requests.get(user_url)
fetch(user_provided_url)
axios.get(untrusted_url)
If MCP server or AI integration detected:
Check for:
MCP-specific:
Create structured security report:
Executive Summary:
# Security Audit Report
**Date:** YYYY-MM-DD
**Scope:** [files/directories reviewed]
**Critical Issues:** N
**High Severity:** N
**Medium Severity:** N
**Low Severity:** N
Critical Issues (Fix Immediately):
High Severity (Fix Soon):
Medium Severity:
Low Severity / Recommendations:
Findings Detail:
For each issue:
### [CRITICAL/HIGH/MEDIUM/LOW] Issue Title
**Location:** file.py:123
**OWASP Category:** A03:2021 - Injection
**CWE:** CWE-89 (SQL Injection)
**Description:**
User input directly concatenated into SQL query without validation.
**Vulnerable Code:**
```python
query = f"SELECT * FROM users WHERE id = {user_id}"
cursor.execute(query)
Impact: Attacker can inject SQL to access unauthorized data, modify records, or execute commands.
Remediation: Use parameterized queries:
query = "SELECT * FROM users WHERE id = ?"
cursor.execute(query, (user_id,))
References:
### Step 7: Prioritize remediation
Provide remediation roadmap:
**Phase 1 (Immediate - Critical):**
1. Remove hardcoded secrets
2. Fix SQL injection vulnerabilities
3. Add authentication to unprotected endpoints
**Phase 2 (This Sprint - High):**
1. Add authorization checks
2. Update vulnerable dependencies
3. Implement rate limiting
**Phase 3 (Next Sprint - Medium):**
1. Add security headers
2. Improve password policies
3. Enhance logging
**Phase 4 (Backlog - Low):**
1. Security documentation
2. Monitoring improvements
3. Security training
### Step 8: Provide fix examples
For common issues, provide complete fix examples:
**SQL Injection Fix:**
```python
# Before (vulnerable)
cursor.execute(f"SELECT * FROM users WHERE email = '{email}'")
# After (secure)
cursor.execute("SELECT * FROM users WHERE email = ?", (email,))
Hardcoded Secret Fix:
# Before (vulnerable)
API_KEY = "sk-1234567890abcdef"
# After (secure)
import os
API_KEY = os.environ.get("API_KEY")
if not API_KEY:
raise ValueError("API_KEY environment variable not set")
Command Injection Fix:
# Before (vulnerable)
os.system(f"ping {user_host}")
# After (secure)
import subprocess
subprocess.run(["ping", user_host], check=True, timeout=5)
Recommend and run automated tools:
Secrets Scanning:
# trufflehog
trufflehog filesystem . --json
# gitleaks
gitleaks detect --source . --verbose
Dependency Scanning:
# Node.js
npm audit --json
# Python
pip-audit --format json
SAST (if available):
# Semgrep
semgrep --config auto .
# Bandit (Python)
bandit -r src/ -f json
Console output:
Detailed report file:
security-audit-report.mdJSON output (for CI/CD):
After review, verify:
Last Updated: 2025-11-13 Framework: OWASP Top 10 2021 Standards: OWASP Security Guidelines