Audit

Audit Skill

Overview

The audit skill provides comprehensive on-demand security and code quality audits for your codebase. It identifies vulnerabilities, security issues, code smells, outdated dependencies, exposed secrets, and compliance problems across all supported technology stacks.

When to Use:

• Security audits and vulnerability scans
• Pre-deployment security checks
• Compliance verification (GDPR, HIPAA, SOC2)
• Code quality assessment
• Dependency vulnerability scanning
• Secret exposure detection
• Third-party license compliance

Technology Coverage:

• React/TypeScript/JavaScript projects
• Go applications
• Rust projects
• Python codebases
• Full-stack applications
• Monorepos and microservices

Audit Categories

1. Security Vulnerabilities (OWASP Top 10)

What Gets Checked:

• SQL injection vulnerabilities
• Cross-site scripting (XSS)
• Authentication and session management flaws
• Security misconfigurations
• Sensitive data exposure
• XML external entities (XXE)
• Broken access control
• Cross-site request forgery (CSRF)
• Using components with known vulnerabilities
• Insufficient logging and monitoring

Detection Methods:

• Static code analysis
• Pattern matching for common vulnerabilities
• Framework-specific security checks
• API endpoint security validation
• Input validation analysis

2. Dependency Vulnerabilities

What Gets Checked:

• Outdated packages with known CVEs
• Unmaintained dependencies
• License compatibility issues
• Transitive dependency risks
• Version conflicts

Package Managers Supported:

• npm/yarn/pnpm (JavaScript/TypeScript)
• go.mod (Go)
• Cargo.toml (Rust)
• requirements.txt/pyproject.toml (Python)
• Gemfile (Ruby)

Tools Used:

• npm audit / yarn audit / pnpm audit
• go mod verify + vulnerability databases
• cargo audit
• pip-audit / safety

3. Exposed Secrets and Credentials

What Gets Detected:

• Hardcoded API keys and tokens
• Database credentials
• Private keys and certificates
• OAuth tokens and secrets
• AWS/GCP/Azure credentials
• JWT secrets
• Encryption keys

Detection Patterns:

• Regex patterns for common secret formats
• Environment variable misuse
• Configuration file analysis
• Git history scanning (if requested)
• Common secret naming patterns

False Positive Reduction:

• Ignore test fixtures and mocks
• Respect .gitignore patterns
• Check for proper environment variable usage
• Validate against .env.example templates

4. Code Quality Issues

What Gets Analyzed:

• Code complexity (cyclomatic complexity)
• Code duplication
• Dead code and unused exports
• Large functions and files
• Naming convention violations
• Magic numbers and hardcoded values
• Lack of error handling
• Poor separation of concerns

Metrics Calculated:

• Cyclomatic complexity per function
• Duplication percentage
• Lines of code (LOC) per file/function
• Comment-to-code ratio
• Test-to-code ratio

Running Audits

Full Audit

Run all audit categories:

Please run a full security and quality audit of this codebase

The audit will:

1. Scan all source files for vulnerabilities
2. Check dependencies for known CVEs
3. Search for exposed secrets
4. Analyze code quality metrics
5. Generate comprehensive report

Category-Specific Audits

Security Only:

Run a security audit focusing on OWASP top 10 vulnerabilities

Dependencies Only:

Audit all dependencies for vulnerabilities and outdated packages

Secrets Only:

Scan for exposed secrets and credentials

Code Quality Only:

Analyze code quality and identify code smells

Targeted Audits

Specific Directory:

Audit the /src/auth directory for security issues

Specific Files:

Audit UserController.ts and AuthService.ts for vulnerabilities

Pre-Deployment:

Run pre-deployment audit checklist

Audit Report Format

Severity Levels

Reports classify findings by severity:

• CRITICAL: Immediate security risk, exploitable vulnerability
• HIGH: Significant security or quality issue
• MEDIUM: Moderate issue that should be addressed
• LOW: Minor issue or code smell
• INFO: Informational finding, best practice suggestion

Report Structure

# Security and Quality Audit Report

**Generated**: 2026-01-28 14:32:00
**Scope**: Full codebase audit
**Files Scanned**: 247
**Duration**: 8.3 seconds

## Executive Summary

- CRITICAL: 2 findings
- HIGH: 5 findings
- MEDIUM: 12 findings
- LOW: 23 findings
- INFO: 8 findings

**Risk Score**: 7.2/10 (HIGH)

## Critical Findings

### [CRITICAL-001] SQL Injection Vulnerability
**File**: src/database/queries.ts:42
**Severity**: CRITICAL
**Category**: Security - SQL Injection

**Issue**: User input concatenated directly into SQL query without sanitization.

**Code**:
```typescript
const query = `SELECT * FROM users WHERE email = '${email}'`;

Impact: Attacker can execute arbitrary SQL commands.

Recommendation: Use parameterized queries or ORM.

Fix:

const query = db.prepare('SELECT * FROM users WHERE email = ?').bind(email);

[CRITICAL-002] Exposed API Key

File: src/config/api.ts:15 Severity: CRITICAL Category: Security - Exposed Secret

Issue: Hardcoded API key found in source code.

Code:

const STRIPE_SECRET_KEY = "sk_live_abc123xyz789";

Impact: Unauthorized access to Stripe account.

Recommendation: Move to environment variable.

Fix:

const STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY;

High Priority Findings

[HIGH-001] Outdated Dependency with Known CVE

File: package.json:23 Severity: HIGH Category: Dependencies

Issue: lodash@4.17.15 has known vulnerability (CVE-2021-23337)

CVE Details:

• CVE-2021-23337: Command injection in template
• Published: 2021-02-15
• CVSS Score: 7.2

Recommendation: Upgrade to lodash@4.17.21 or higher

Fix:

npm install lodash@latest

[... additional findings ...]

Compliance Checks

OWASP Top 10 Coverage

• [FAIL] A1: Injection - 2 SQL injection vulnerabilities found
• [PASS] A2: Broken Authentication
• [FAIL] A3: Sensitive Data Exposure - 1 exposed secret
• [PASS] A4: XML External Entities
• [PASS] A5: Broken Access Control
• [FAIL] A6: Security Misconfiguration - CORS too permissive
• [PASS] A7: Cross-Site Scripting
• [PASS] A8: Insecure Deserialization
• [FAIL] A9: Using Components with Known Vulnerabilities - 3 outdated deps
• [WARN] A10: Insufficient Logging - Limited audit logging

Overall: 6/10 passing (60%)