From argos
OWASP Top 10 (2021) review disipline — A01 Broken Access Control (IDOR, CORS, JWT scope, force browse), A02 Cryptographic Failures (TLS 1.2+, HSTS, argon2id, secret manager, log redact), A03 Injection (parameterized query, allowlist input, output encoding, shell=False), A04 Insecure Design (threat model, misuse case, defense-in-depth, rate limit), A05 Security Misconfiguration (security header, default cred, verbose error, container hardening), A06 Vulnerable Components (SBOM, CVE SLA, EOL stack), A07 Auth Failures (MFA, session rotation, JWT validate, OAuth PKCE/state), A08 Integrity (signed CI/CD, SLSA, deserialization safe, webhook HMAC), A09 Logging Failures (auth event, WORM, PII redact, alert), A10 SSRF (URL allowlist, metadata block, DNS rebind). CI gate önerisi (gitleaks, semgrep, trivy, OSV, ZAP).
npx claudepluginhub resultakak/argos --plugin argosThis skill uses the workspace's default tool permissions.
`agents/shared/severity-rubric.md` ve `agents/shared/escalation-matrix.md`
Mandates invoking relevant skills via tools before any response in coding sessions. Covers access, priorities, and adaptations for Claude Code, Copilot CLI, Gemini CLI.
Share bugs, ideas, or general feedback.
agents/shared/severity-rubric.md ve agents/shared/escalation-matrix.md
default-load sayılır (agents/coordination.md §11). Bu skill'in çıktısı
Critical / High / Medium / Low + kanıt formatında olmak zorunda — spekülatif
Critical yasak. Sahiplik dışı bulgu ilgili agent'a delege; karar yetkisi eşiği
aşılırsa kullanıcı onayı zorunlu.
# IDOR sweep — endpoint scope check
grep -rn "request.params\|req.params" src/ | grep -i "id"
# CORS audit
grep -rn "Access-Control-Allow-Origin" .
curl -I -H "Origin: https://evil.com" https://api.acme.com/me
/orders/{id} owner verify?* + credentials YASAK kontrol./admin path scope check?# Password hashing scan
grep -rnE "md5|sha1|sha256.*password" src/
# Hard-coded secret
gitleaks detect --no-banner
# Sensitive in log
grep -rnE "log.*password|log.*token|log.*card" src/
secrets, crypto.randomBytes)?# SQL string concat
grep -rnE "execute\(.*f\"|execute\(.*\+|raw\(.*\+" src/
# Shell injection
grep -rn "shell=True\|os.system\|popen" src/
# eval/exec
grep -rnE "\beval\(|\bexec\(" src/
subprocess.run([...], shell=False)?# Security header probe
curl -sI https://acme.com/ | grep -iE "strict-transport|content-security|x-frame|x-content-type|referrer-policy"
# Verbose error prob
curl -s "https://api.acme.com/order/'" | head -50 # SQL bozuk → stack trace?
# Server header
curl -sI https://acme.com/ | grep -iE "^server|x-powered-by"
X-Powered-By / Server header strip?# Python
pip-audit
# Node
npm audit --omit=dev
# Go
govulncheck ./...
# Container
trivy image acme/api:1.4.7 --severity HIGH,CRITICAL
# OSV
osv-scanner -r .
exp ≤ 15dk + refresh + iss/aud/nbf/iat validate + alg pin (none YASAK)?# URL fetch endpoints
grep -rnE "requests\.get\(|fetch\(|axios\(|urllib\.urlopen\(" src/ | grep -v "config\.\|env\.\|const URL"
| Sev | OWASP | Bulgu | Kanıt | Sahip | Tarih |
| Critical | A01 | `/orders/{id}` IDOR — owner check yok | `tests/idor_test.py:42` 200 dönüyor başka tenant id ile | @backend | 2026-05-18 |
| High | A02 | Password bcrypt cost 4 (12 olmalı) | `auth/hash.py:11` `bcrypt.gensalt(4)` | @backend | 2026-05-23 |
| High | A05 | CSP `unsafe-inline` | response header dump | @frontend | 2026-05-30 |
| Medium | A07 | JWT exp 24h (15dk + refresh olmalı) | `auth/jwt.py:8` | @backend | 2026-06-06 |
rules/owasp-top10.md "Yasaklar" listesi tam tutar; tekrar yok.
Özet: authz yok + CORS * + cred / SHA password / Math.random token / shell=True / verbose error / HSTS yok / CSP unsafe-inline / container root / EOL / MFA yok admin / JWT none / OAuth state yok / pickle untrusted / SSRF metadata open / log PII / webhook HMAC yok / Critical CVE > 7g / SBOM yok.
security-reviewer agent — ana sahip; bu skill prosedür taşır.threat-modeling skill — A04 insecure design (STRIDE).secure-deployment-review skill — A05 misconfig + A06 component + container.dependency-risk-auditor agent — A06 CVE + license.production-readiness-reviewer — A09 logging + alert gate.compliance-controls skill — SOC 2 / ISO mapping.incident-commander — A09 alert response prosedür.# OWASP Top 10 Review: checkout-svc
## Scope
- Repo: github.com/acme/checkout-svc @ v1.4.7
- Endpoint sayısı: 23
- Stack: Python 3.12 / FastAPI / Postgres / Redis
- Container: distroless-python:3.12-slim
## Findings (12 toplam: 3 Critical / 4 High / 3 Medium / 2 Low)
### A01 Broken Access Control
- **Critical** — `/orders/{id}` IDOR (owner check yok)
- **High** — Admin path `/admin/refund` JWT scope check eksik
### A02 Cryptographic Failures
- **Critical** — Password SHA-256 (argon2id olmalı)
- **High** — Sensitive log redact yok (email + last4 card)
### A03 Injection
- **Medium** — Raw SQL 2 endpoint (parameterize)
### A05 Security Misconfiguration
- **High** — CSP yok response
- **Medium** — Container root user
- **Low** — `X-Powered-By` header expose
### A06 Vulnerable Components
- **Critical** — `cryptography==3.4.7` (CVE-2023-23931 Critical)
- **Medium** — Python 3.10 (EOL 2026-10; 3.12 plan)
### A07 Auth Failures
- **High** — JWT exp 24h (15dk + refresh olmalı)
- **Low** — Session rotation auth sonrası yok
## Action Items
| P0 | A01 IDOR owner check | @backend | 2026-05-18 |
| P0 | A02 password argon2id migration | @backend | 2026-05-23 |
| P0 | A06 cryptography 41+ bump | @platform | 2026-05-18 |
| P1 | A01 admin scope guard | @backend | 2026-05-23 |
| P1 | A02 sensitive log redact | @backend | 2026-05-30 |
| P1 | A05 CSP strict + report-uri | @frontend | 2026-05-30 |
| P1 | A07 JWT exp 15dk + refresh | @backend | 2026-06-06 |
| P2 | A03 parameterized query 2 endpoint | @backend | 2026-06-13 |
| P2 | A05 container non-root + RO FS | @platform | 2026-06-13 |
| P2 | A06 Python 3.12 upgrade | @platform | 2026-08-30 |
| P3 | A05 X-Powered-By strip | @platform | 2026-06-30 |
| P3 | A07 session rotation | @backend | 2026-06-30 |
## CI Gate Additions
- pre-commit: gitleaks + semgrep
- CI: pip-audit + trivy HIGH+ fail + ZAP baseline smoke
- pre-prod: threat model her PR `security` label