Security Audit Skill

This skill provides a comprehensive framework for security auditing, ensuring that common vulnerabilities are identified and addressed during development and review.

Audit Checklist

1. OWASP Top 10 & Common Vulnerabilities

• Injection: Check for SQL, Command, or NoSQL injection points. Ensure parameterized queries or proper escaping is used.
• Broken Access Control: Verify that users cannot access resources outside of their intended permissions.
• Insecure Design: Evaluate the overall architecture for security flaws.
• Cryptographic Failures: Ensure sensitive data (passwords, PII) is encrypted at rest and in transit using modern algorithms (e.g., AES-256, TLS 1.3).

2. Dependency Management

• Vulnerability Scanning: Check for known vulnerabilities in third-party libraries (e.g., using npm audit, pip-audit, or snyk).
• Outdated Packages: Identify and update significantly outdated dependencies.