security-ops

Security Operations

Orchestrator for security auditing. Detects project stack inline, dispatches three parallel audit agents (dependency, SAST, auth/config review), consolidates into a severity-ranked OWASP-mapped report. Ships one-topic references for PHP 8.x, Twig and Craft CMS 3/4/5.

Findings use OWASP Top 10:2025 IDs (https://top10.owasp.org/2025/), as the references do - write them A05:2025 so every report names its revision. 2025 renumbered the list (Injection A03 -> A05, Misconfiguration A05 -> A02, SSRF folded into A01, new A03 Supply Chain and A10 Exceptional Conditions); translate 2021-tagged reports through the crosswalk in references/audit-quickref.md, never by bare number.

Stack Routing

Load references by what T1 detects. Each is one topic, 300 lines or fewer, opens with a Contents list, and ends with a review checklist of ready-to-run rg patterns.

Detected	Reference	Covers
Any web app	references/owasp-top10-a01-a05.md	A01-A05:2025: access control + SSRF, misconfig, supply chain, crypto, injection
	references/owasp-top10-a06-a10.md	A06-A10:2025: design, authn, integrity, logging + alerting, exceptional conditions
	references/audit-quickref.md	Triage sheet: 2025 table, 2021->2025 crosswalk, validation, secrets, grep patterns
	references/secure-headers.md	CSP, HSTS, framing, referrer and permissions headers
Auth / crypto code	references/auth-patterns.md	Password hashing, sessions, JWT, OAuth2
	references/auth-account-protection.md	MFA, rate limiting, lockout, password reset
	references/crypto-patterns.md	AES-GCM, KDFs, signatures, key storage
PHP 8.x (composer.json)	references/php-input-validation.md	Request helpers, filter_var, type juggling, paths, mass assignment
	references/php-sql-queries.md	Query builder vs raw SQL, identifiers, PDO, element-query params
	references/php-deserialisation.md	unserialize, JSON, phar, signed data
	references/php-password-hashing.md	password_hash, Argon2id/bcrypt, legacy hashes, tokens
	references/php-composer-supply-chain.md	composer audit, advisory blocking, allow-plugins, prod installs
Twig	references/twig-escaping.md	Autoescape, context strategies, |raw, Craft output helpers
	references/twig-template-injection.md	SSTI sinks, dynamic includes, Craft's sandbox, Twig floors
Craft CMS (craftcms/cms)	references/craft-config-hardening.md	.env, security key, devMode, production settings
	references/craft-access-control.md	Permissions, allowAnonymous, require helpers, element auth
	references/craft-csrf-forms.md	csrfInput, hashed inputs, static caching, Blitz, Formie
	references/craft-uploads-assets.md	Allowed types, private volumes, transform CVEs
	references/craft-graphql-security.md	Schemas, tokens, limits, introspection, CORS
	references/craft-advisories.md	Support windows, exploited CVEs, triage, EOL mitigation
DDEV (.ddev/config.yaml)	references/ddev-config-drift.md	Local vs production PHP/Craft settings, data, ddev share; DDEV mechanics and a .ddev/ auditor: ddev-ops

Craft 3 and Craft 4 are past security end of life (2024-04-30 and 2026-04-30); any audit of one leads with that finding (craft-advisories.md).

Architecture

User requests security audit or mentions security concern
    |
    +---> T1: Detect (inline, fast)
    |       +---> Identify languages/frameworks in project
    |       +---> Check installed audit tools
    |       +---> Determine scope (changed files vs full codebase)
    |       +---> Present: detection summary + recommended audit
    |
    +---> T2: Audit (3 parallel agents, background)
    |       +---> Agent 1: Dependency Audit
    |       |       +---> Run pip-audit, npm audit, govulncheck, cargo audit, trivy
    |       |       +---> Report: CVE IDs, severity, affected + fix versions
    |       |
    |       +---> Agent 2: Code Pattern Scan (SAST)
    |       |       +---> Hardcoded secrets, injection, XSS, eval, shell, weak crypto
    |       |       +---> Report: file:line, pattern, severity, fix suggestion
    |       |
    |       +---> Agent 3: Auth & Config Review
    |       |       +---> Session, CSRF, CORS, CSP, JWT, OAuth, rate limiting, env vars
    |       |       +---> Report: finding, severity, OWASP category, remediation
    |       |
    |       +---> Consolidate: deduplicate, rank by severity, map to OWASP Top 10:2025
    |
    +---> T3: Remediate (dispatch general-purpose + skill preload, foreground + confirm)
            +---> Agent proposes specific fixes
            +---> Preflight: what changes, security impact, risk of breaking
            +---> User confirms
            +---> Apply fixes

Safety Tiers

Operation	Tier	Execution
Detect languages/frameworks	T1	Inline
Check installed audit tools	T1	Inline
Determine scope (changed vs all)	T1	Inline
Dependency vulnerability scan	T2	Agent 1 (bg)
Code pattern scan (SAST)	T2	Agent 2 (bg)
Auth & config review	T2	Agent 3 (bg)
Consolidate findings	T2	Inline (after agents return)
Fix vulnerability in code	T3	Skill-preloaded agent + confirm
Update vulnerable dependency	T3	Skill-preloaded agent + confirm
Add security headers	T3	Skill-preloaded agent + confirm

T1: Detect - Run Inline

Check	Command / Method
Python project	Check for requirements.txt, pyproject.toml, Pipfile
Node.js project	Check for package.json, package-lock.json
Go project	Check for go.mod
Rust project	Check for Cargo.toml
Docker	Check for Dockerfile, docker-compose.yml
PHP project	Check for composer.json, composer.lock; PHP version from config.platform.php or require.php
Craft CMS	craftcms/cms in composer.json; version via composer show craftcms/cms
Twig templates	fd -e twig, or .html files under templates/ in a Craft project
DDEV	Check for .ddev/config.yaml (run PHP tools via ddev composer / ddev exec)
composer available	which composer 2>/dev/null (composer audit needs 2.4+)
pip-audit available	which pip-audit 2>/dev/null
npm audit available	which npm 2>/dev/null
govulncheck available	which govulncheck 2>/dev/null
cargo-audit available	which cargo-audit 2>/dev/null
trivy available	which trivy 2>/dev/null
Scope: changed files	git diff --name-only HEAD
Scope: full codebase	fd -e py -e js -e ts -e go -e rs -e php -e twig

T2: Audit - Dispatch 3 Parallel Agents

All audit agents use model="sonnet", run_in_background=True. All are read-only - instruct them explicitly to never edit files.

Copy each prompt from references/audit-agent-prompts.md, filling the {...} slots from T1. What each agent does, so you can route and sanity-check its output:

Agent	Reads first	Finds	Reports
1 Dependency audit	scripts/dependency-audit.sh; PHP: php-composer-supply-chain.md, Craft: craft-advisories.md	Vulnerable packages via pip-audit, npm audit, govulncheck, cargo audit, trivy, composer audit --locked	Severity-ranked table: package, version, CVE, fixed version, A03:2025
2 Code pattern scan (SAST)	scripts/security-scan.sh, both owasp-top10-*.md; PHP/Twig refs when detected	Injection, SSRF, hardcoded secrets, weak crypto, unsafe deserialisation, fail-open exception handling; PHP/Twig checklist rg patterns	file:line, pattern, OWASP 2025 ID, severity, fix - grouped by category
3 Auth and config review	auth-patterns.md, auth-account-protection.md, secure-headers.md; Craft/DDEV refs when detected	Authn, authz, CSRF, CORS, headers, cookies, sessions, error handling; Craft and DDEV checklists	PASS/FAIL/N-A checklist, findings grouped by category

Consolidation

After all 3 agents return, consolidate inline:

1. Deduplicate - Remove findings that appear in multiple agents (e.g., hardcoded secret found by both Agent 1 and Agent 2)
2. Rank by severity:
   • Critical: Remote code execution, SQL injection, exposed secrets in production (incl. unserialize() of request data, Twig SSTI, a committed Craft security key, a Craft version inside a CISA-KEV-listed range)
   • High: XSS, broken auth, missing access control, known CVE with exploit (incl. Craft 3/4 past end of life, devMode on in production, $allowAnonymous = true on state-changing actions, an authorization check that fails open on exception)
   • Medium: Weak crypto, missing security headers, insecure defaults
   • Low: Informational, best practice suggestions, TODO items
3. Map to OWASP Top 10:2025 - Tag each finding Axx:2025 <Category> (e.g. A05:2025 Injection). When merging with or diffing against an older report, translate its 2021 IDs through the crosswalk in references/audit-quickref.md - the same bare number means different categories in the two revisions
4. Generate report (see Report Format below)

T3: Remediate - Skill-Preloaded Dispatch with Confirmation

When user wants to fix findings, dispatch a general-purpose agent preloaded with the relevant language -ops skill.

Language routing (same as perf-ops):

Finding Type	Dispatch	Preload
Python vulnerability	general-purpose	relevant skills/python-*/SKILL.md by topic
Node.js/JS vulnerability	general-purpose	skills/javascript-ops/SKILL.md
TypeScript vulnerability	general-purpose	skills/typescript-ops/SKILL.md
Go vulnerability	general-purpose	skills/go-ops/SKILL.md
Rust vulnerability	general-purpose	skills/rust-ops/SKILL.md
SQL injection / DB security	general-purpose	skills/postgres-ops/SKILL.md
Craft CMS / Twig / PHP	general-purpose	skills/craftcms-ops/SKILL.md + the matching php-, twig- or craft- reference here
Laravel	general-purpose	skills/laravel-ops/SKILL.md
Composer / dependency supply chain (A03:2025)	general-purpose	skills/supply-chain-defense/SKILL.md
General / config / headers	general-purpose	-

Dispatch with the T3 preflight prompt in references/audit-agent-prompts.md: the agent proposes changes, security impact, breakage risk, verification and revert first, and applies nothing until the user confirms.

Report Format

Write the report from the template in references/audit-agent-prompts.md (Report Format): scope, languages, OWASP revision: Top 10:2025, a per-category severity summary, findings by severity with file:line and OWASP 2025 ID, then passed checks.

Fallback: When Agents Are Unavailable

If agent dispatch fails, fall back to inline scanning:

1. Run scripts/dependency-audit.sh directly via Bash
2. Run scripts/security-scan.sh directly via Bash
3. Manually check auth patterns using ripgrep
4. Present combined results (less structured than agent-based audit)

Reference index: see Stack Routing at the top.

Scripts

Script	Purpose
scripts/dependency-audit.sh	Multi-language dependency vulnerability scanner (pip-audit, npm, govulncheck, cargo, trivy, composer)
scripts/security-scan.sh	ripgrep-based code pattern scanner (Python, JS, PHP, Twig, Craft config)

See Also

Skill	When to Combine
auth-ops	Deep authentication/authorization implementation patterns
craftcms-ops	Craft content modelling, Twig, element queries, plugins - the "how", where this skill is the "how safely"
supply-chain-defense	Behavioural dependency scanning, release cooldowns, IOC matching - beyond composer audit
laravel-ops	Laravel-specific remediation
testing-ops	Security-focused test case generation
monitoring-ops	Security event logging and alerting
debug-ops	Investigating security incidents