security-audit

Security Audit Skill

This skill comprehensively detects security vulnerabilities.

Overview

Conduct security audits of code and system configurations based on the OWASP Top 10, CVEs, and security best practices.

Main Features

OWASP Top 10 Check: SQL injection, XSS, CSRF, authentication flaws, etc.
Dependency vulnerabilities: Detection of libraries with known CVEs
Sensitive information leakage: Hardcoded API keys, passwords, tokens
Cryptography assessment: Weak cryptography, inappropriate hash algorithms
Authentication and authorization: Issues with JWT, OAuth, session management
Secure Coding: Input validation, output escaping
HTTPS/TLS configuration: Certificates, cipher suites, protocol versions
CORS/CSP configuration: Appropriateness of security headers
File Upload: File extensions, MIME type validation
Rate limiting: DDoS and brute force countermeasures

Usage

Basic security audit

このコードのセキュリティ監査を実施：
[コード]

重点項目:
- SQLインジェクション
- XSS
- 認証・認可

OWASP Top 10 Scan

OWASP Top 10 の観点で以下を監査：
[プロジェクトディレクトリ]

出力: 重大度別レポート

Dependency audit

package.json / requirements.txt の脆弱性チェック：
既知のCVEを検出
推奨アップデート提案

Check items

1. Injection attacks

SQL Injection:

# ❌ 脆弱
query = f"SELECT * FROM users WHERE id = {user_id}"

# ✅ 安全
query = "SELECT * FROM users WHERE id = ?"
cursor.execute(query, (user_id,))

Command Injection:

// ❌ 脆弱
exec(`ping ${userInput}`);

// ✅ 安全
execFile('ping', [userInput]);

NoSQL Injection:

// ❌ 脆弱
db.users.find({ username: req.body.username });

// ✅ 安全
db.users.find({ username: { $eq: req.body.username } });

2. XSS (Cross-Site Scripting)

// ❌ 脆弱
element.innerHTML = userInput;

// ✅ 安全
element.textContent = userInput;
// または
element.innerHTML = DOMPurify.sanitize(userInput);

3. Authentication and session management

# ❌ 弱いパスワードハッシュ
password_hash = md5(password)

# ✅ 強力なハッシュ
password_hash = bcrypt.hashpw(password, bcrypt.gensalt(rounds=12))

# ❌ 予測可能なセッションID
session_id = str(user_id) + str(time.time())

# ✅ 暗号学的に安全
session_id = secrets.token_urlsafe(32)

4. Exposure of sensitive information

// ❌ ハードコード
const API_KEY = "sk_live_abc123xyz";

// ✅ 環境変数
const API_KEY = process.env.API_KEY;

// ❌ ログに機密情報
console.log("User password:", password);

// ✅ 機密情報を除外
console.log("User authenticated:", userId);

5. Access control

// ❌ 不十分な認可チェック
app.delete('/api/users/:id', (req, res) => {
  User.delete(req.params.id);
});

// ✅ 適切な権限確認
app.delete('/api/users/:id', requireAuth, (req, res) => {
  if (req.user.id !== req.params.id && !req.user.isAdmin) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  User.delete(req.params.id);
});

6. Security misconfiguration

// ❌ 不適切なCORS
app.use(cors({ origin: '*' }));

// ✅ 適切なCORS
app.use(cors({
  origin: ['https://example.com'],
  credentials: true
}));

// ❌ 弱いCSP
helmet.contentSecurityPolicy({
  directives: { defaultSrc: ["'unsafe-inline'", "'unsafe-eval'"] }
});

// ✅ 強力なCSP
helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'"],
    styleSrc: ["'self'", "'unsafe-inline'"],
  }
});

Output example

# セキュリティ監査レポート

## サマリー
- **Critical**: 2件
- **High**: 5件
- **Medium**: 8件
- **Low**: 3件

## Critical 問題

### [CRITICAL] SQLインジェクション脆弱性
**ファイル**: api/users.py:45
**問題**: ユーザー入力を直接SQL クエリに埋め込んでいます
**影響**: データベース全体への不正アクセス、データ漏洩
**CVE参照**: CWE-89

**脆弱なコード**:
```python
query = f"SELECT * FROM users WHERE username = '{username}'"

Proposed fix:

query = "SELECT * FROM users WHERE username = ?"
cursor.execute(query, (username,))

Priority: Immediate fix required

[CRITICAL] Hardcoded API Key

File: config/api.js:12 Issue: The Stripe API key is written directly in the code Impact: Potential leakage of the API key and unauthorized billing

Current:

const stripeKey = "sk_live_abc123xyz";

Recommended:

const stripeKey = process.env.STRIPE_SECRET_KEY;

High issues

[HIGH] Weak password hashing (MD5)

File: auth/password.py:23 Issue: Passwords are hashed with MD5 Impact: Vulnerable to rainbow table attacks

Recommended: Use bcrypt or Argon2

[HIGH] XSS vulnerability

File: views/profile.html:67 Issue: User input is displayed without escaping Impact: Cross-site scripting attacks

Dependency vulnerabilities

Package	Version	CVE	Severity	Recommended
lodash	4.17.15	CVE-2020-8203	High	4.17.21+
axios	0.18.0	CVE-2020-28168	Medium	0.21.1+

Recommended actions

Immediate response (Critical/High):

Fix SQL injection
Remove hardcoded keys
Change the password hashing algorithm
Implement XSS countermeasures
Update dependencies

Short-term response (Medium):

Tighten CORS configuration
Add CSP headers
Implement rate limiting

Security Checklist

Validate and sanitize all user input
Use parameterized queries
Use strong encryption algorithms
Manage sensitive information with environment variables
Enforce HTTPS
Configure security headers
Keep dependencies up to date
Do not leak information in error messages


## ベストプラクティス

1. **多層防御**: 複数のセキュリティレイヤーを実装
2. **最小権限の原則**: 必要最小限の権限のみ付与
3. **セキュアバイデフォルト**: デフォルト設定を安全に
4. **定期的な監査**: 継続的なセキュリティチェック
5. **依存関係管理**: 定期的なアップデートとスキャン

## バージョン情報

- スキルバージョン: 1.0.0
- 最終更新: 2025-01-22