Security Audit

Security Audit

This skill enables the agent to conduct a thorough security audit across web applications, APIs, cloud infrastructure, and backend services. The agent systematically examines authentication mechanisms, authorization controls, input validation, encryption practices, logging configurations, and deployment settings. Findings are mapped to industry frameworks such as the OWASP Top 10, CWE identifiers, and compliance standards including SOC 2 and PCI-DSS.

Workflow

1. Gather System Information — Collect details about the target environment including the technology stack, architecture diagrams, network topology, deployment model, and third-party integrations. Review configuration files, environment variables, and infrastructure-as-code templates to build a complete picture of the attack surface.

2. Define Audit Scope and Compliance Targets — Establish the boundaries of the audit by identifying which components, environments, and data flows are in scope. Map audit objectives to relevant compliance frameworks such as SOC 2 Type II, PCI-DSS, HIPAA, or internal security policies. Create a checklist derived from the OWASP Top 10 and CWE/SANS Top 25 to ensure systematic coverage.

3. Perform Automated Vulnerability Scanning — Run automated scanners against the target to identify known vulnerabilities. Use tools like OWASP ZAP for web applications, Trivy or Grype for container images, and ScoutSuite or Prowler for cloud infrastructure. Aggregate raw findings for manual review.

4. Conduct Manual Security Review — Manually inspect authentication flows, session management, role-based access controls, input sanitization routines, cryptographic implementations, error handling, and logging practices. Examine source code for hardcoded secrets, insecure deserialization, and business logic flaws that automated tools frequently miss.

5. Analyze and Classify Findings — Assess each finding for severity (Critical, High, Medium, Low, Informational) using CVSS scoring. Assign CWE identifiers and map findings to the relevant OWASP Top 10 category. Evaluate exploitability, blast radius, and business impact to produce a prioritized risk ranking.

6. Generate Audit Report with Remediation Plan — Produce a structured report containing an executive summary, detailed findings with evidence and reproduction steps, risk ratings, and specific remediation recommendations with estimated effort. Include a compliance gap analysis showing pass/fail status against the targeted framework controls.

Supported Technologies

• Web Frameworks: Express.js, Django, Flask, Spring Boot, Rails, ASP.NET
• Cloud Platforms: AWS (IAM, S3, EC2, RDS, Lambda), GCP, Azure
• Container & Orchestration: Docker, Kubernetes, ECS
• Scanning Tools: OWASP ZAP, Prowler, ScoutSuite, Trivy, Grype, Checkov
• Compliance Frameworks: OWASP Top 10, CWE/SANS Top 25, SOC 2, PCI-DSS, HIPAA, NIST 800-53

Usage

Provide the agent with access to the application source code, infrastructure configuration, or a target URL along with the desired compliance scope. The agent will execute the full audit workflow and deliver a prioritized findings report.

Prompt example:

Perform a security audit of the Node.js Express application in /app. Focus on OWASP Top 10 coverage and SOC 2 compliance. Include CWE IDs and remediation steps for every finding.

Examples

Example 1: Auditing a Node.js Express Application

Target: E-commerce API built with Express.js, Sequelize ORM, and JWT authentication.

Findings Report (excerpt):

Remediation for Finding #1:

// BEFORE — vulnerable to SQL injection
app.get('/api/products', async (req, res) => {
  const results = await sequelize.query(
    `SELECT * FROM products WHERE name LIKE '%${req.query.search}%'`
  );
  res.json(results);
});

// AFTER — parameterized query
app.get('/api/products', async (req, res) => {
  const results = await sequelize.query(
    'SELECT * FROM products WHERE name LIKE :search',
    { replacements: { search: `%${req.query.search}%` }, type: QueryTypes.SELECT }
  );
  res.json(results);
});

Example 2: Auditing AWS Infrastructure

Target: Production AWS account running a three-tier web application.

Prowler scan command:

prowler aws --compliance soc2 pci_dss --output-formats json html --output-directory ./audit-report

Findings Report (excerpt):

Remediation for Finding #2:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["ecr:GetAuthorizationToken", "ecs:UpdateService", "ecs:DescribeServices"],
      "Resource": "arn:aws:ecs:us-east-1:123456789012:service/prod-cluster/web-service"
    }
  ]
}