From charon-fan-agent-playbook
Audits codebases for OWASP Top 10 vulnerabilities including broken access control, cryptographic failures, injections, insecure design, and misconfigurations using targeted grep and bash checks.
npx claudepluginhub zhaono1/agent-playbookThis skill is limited to using the following tools:
Expert in identifying security vulnerabilities following OWASP Top 10 and security best practices.
Performs OWASP Top 10-aligned security audits on code, checking injection, broken access control, cryptographic failures, misconfigurations, and more.
Audits web app codebases against OWASP Top 10 (2021) vulnerabilities like broken access control, IDOR, insecure configs with file:line findings and remediation. Quick or deep scan modes.
Reviews project code against OWASP Top 10 vulnerabilities: broken access control, injections (SQL, XSS, CSRF), cryptographic failures, insecure design, misconfigurations, and authentication issues.
Share bugs, ideas, or general feedback.
Expert in identifying security vulnerabilities following OWASP Top 10 and security best practices.
Activates when you:
Checks:
# Check for missing auth on protected routes
grep -r "@RequireAuth\|@Protected" src/
# Check for IDOR vulnerabilities
grep -r "req.params.id\|req.query.id" src/
# Check for role-based access
grep -r "if.*role.*===" src/
Common Issues:
Checks:
# Check for hardcoded secrets
grep -ri "password.*=.*['\"]" src/
grep -ri "api_key.*=.*['\"]" src/
grep -ri "secret.*=.*['\"]" src/
# Check for weak hashing
grep -r "md5\|sha1" src/
# Check for http URLs
grep -r "http:\/\/" src/
Common Issues:
Checks:
# SQL injection patterns
grep -r "\".*SELECT.*+.*\"" src/
grep -r "\".*UPDATE.*SET.*+.*\"" src/
# Command injection
grep -r "exec(\|system(\|spawn(" src/
grep -r "child_process.exec" src/
# Template injection
grep -r "render.*req\." src/
Common Issues:
Checks:
# Check for rate limiting
grep -r "rateLimit\|rate-limit\|throttle" src/
# Check for 2FA
grep -r "twoFactor\|2fa\|mfa" src/
# Check for session timeout
grep -r "maxAge\|expires\|timeout" src/
Common Issues:
Checks:
# Check for debug mode
grep -r "DEBUG.*=.*True\|debug.*=.*true" src/
# Check for CORS configuration
grep -r "origin.*\*" src/
# Check for error messages
grep -r "console\.log.*error\|console\.error" src/
Common Issues:
Checks:
# Check package files
cat package.json | grep -E "\"dependencies\"|\"devDependencies\""
cat requirements.txt
cat go.mod
# Run vulnerability scanner
npm audit
pip-audit
Common Issues:
Checks:
# Check password hashing
grep -r "bcrypt\|argon2\|scrypt" src/
# Check password requirements
grep -r "password.*length\|password.*complex" src/
# Check for password in URL
grep -r "password.*req\." src/
Common Issues:
Checks:
# Check for subresource integrity
grep -r "integrity\|crossorigin" src/
# Check for signature verification
grep -r "verify.*signature\|validate.*token" src/
Common Issues:
Checks:
# Check for sensitive data in logs
grep -r "log.*password\|log.*token\|log.*secret" src/
# Check for audit trail
grep -r "audit\|activity.*log" src/
Common Issues:
Checks:
# Check for arbitrary URL fetching
grep -r "fetch(\|axios(\|request(\|http\\.get" src/
# Check for webhook URLs
grep -r "webhook.*url\|callback.*url" src/
Common Issues:
Run security audit:
python scripts/security_audit.py
Check for secrets:
python scripts/find_secrets.py
references/owasp.md - OWASP Top 10 detailsreferences/checklist.md - Security audit checklistreferences/remediation.md - Vulnerability remediation guide