Help us improve
Share bugs, ideas, or general feedback.
From cms-cultivator
Automatically scans code for security vulnerabilities like XSS, SQL injection, CSRF, and authentication flaws.
npx claudepluginhub kanopi/claude-toolbox --plugin cms-cultivatorHow this skill is triggered — by the user, by Claude, or both
Slash command
/cms-cultivator:security-scannerThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Automatically scan code for security vulnerabilities.
Reviews project code against OWASP Top 10 vulnerabilities: broken access control, injections (SQL, XSS, CSRF), cryptographic failures, insecure design, misconfigurations, and authentication issues.
Runs OWASP Top 10 security audits with configurable depth, scope, and output formats. Supports Drupal and WordPress codebases.
Performs systematic security code review for vulnerabilities including injection, XSS, authentication, authorization, and cryptography issues. Reports only high-confidence exploitable findings after tracing data flow and checking framework protections.
Share bugs, ideas, or general feedback.
Automatically scan code for security vulnerabilities.
Security is a continuous practice, not a one-time fix.
/audit-security command): Full OWASP Top 10 scan with dependency checksThis skill provides rapid feedback during development. For production readiness, use comprehensive audits + professional pentesting.
Activate this skill when the user:
Before scanning for security issues, assess:
Critical risks (prioritize first):
High risks:
Medium/Low risks:
User-facing:
Backend:
Authentication/Authorization:
Drupal:
hasPermission()WordPress:
wpdb->prepare() for querieswp_nonce_field() for CSRFesc_html(), esc_attr() for outputcurrent_user_can()User shows code or asks about security
↓
Identify attack surface (input/auth/files)
↓
Assess risk level (Critical/High/Medium)
↓
Check against OWASP Top 10
↓
Apply platform-specific patterns
↓
Report vulnerabilities with fixes
↓
Prioritize by exploitability and impact
eval(), unserialize(), or exec() with user inputFor detailed before/after code examples for SQL injection, XSS, CSRF, file uploads, and access control, see security-patterns.md.
Key categories: SQL injection, XSS (output escaping), CSRF (nonce/token validation), authentication bypass, insecure file uploads.
## Security Scan Results
### 🔴 Critical Issues (Fix Immediately)
**1. SQL Injection Vulnerability**
- **Location**: `src/Controller/UserController.php:45`
- **Risk**: Critical - Allows database manipulation
- **Code**:
```php
$query = "SELECT * FROM users WHERE id = " . $_GET['id'];
$query = $connection->select('users', 'u')
->condition('id', $id, '=')
->execute();
2. Missing CSRF Protection
src/Form/DeleteForm.php:673. Weak Password Policy
## OWASP Top 10 Quick Check
1. **Injection** - SQL, command, LDAP injection
2. **Broken Authentication** - Weak passwords, session management
3. **Sensitive Data Exposure** - Unencrypted data, weak crypto
4. **XML External Entities (XXE)** - XML parsing vulnerabilities
5. **Broken Access Control** - Missing permission checks
6. **Security Misconfiguration** - Default configs, verbose errors
7. **XSS** - Unescaped user input
8. **Insecure Deserialization** - Unsafe object deserialization
9. **Known Vulnerabilities** - Outdated dependencies
10. **Insufficient Logging** - No audit trail
## Platform-Specific Security
### Drupal Security
**Use**:
- `\Drupal\Component\Utility\Html::escape()` for output
- `\Drupal::database()->select()` for queries
- `\Drupal::csrfToken()->validate()` for forms
- `$this->currentUser()->hasPermission()` for access checks
### WordPress Security
**Use**:
- `esc_html()`, `esc_attr()`, `esc_url()` for output
- `$wpdb->prepare()` for queries
- `wp_verify_nonce()` for forms
- `current_user_can()` for permissions
## Integration with /audit-security Command
- **This Skill**: Focused code-level security checks
- "Is this query secure?"
- "Check this form for vulnerabilities"
- Single function/file analysis
- **`/audit-security` Command**: Comprehensive security audit
- Full OWASP Top 10 scan
- Dependency vulnerability check
- File permission analysis
- Secrets detection
## Common Vulnerabilities
For input validation, output escaping, and access control code patterns, see [security-patterns.md](security-patterns.md).
## Resources
- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [Drupal Security Best Practices](https://www.drupal.org/docs/security-in-drupal)
- [WordPress Security](https://developer.wordpress.org/apis/security/)