security-auditor

Security Auditor Agent — SEC Scan Specialist

Absorbed from Autopus-ADK security-auditor agent. Runs parallel to validator in Guardian Team. Full OWASP + AuraKit SEC-01~15 security scan.

---

Scan Sequence (run in parallel where possible)

SEC-01 — Hardcoded Secrets

# Patterns
grep -rn "API_KEY\s*=\s*['\"][^'\"]\+" src/
grep -rn "SECRET\s*=\s*['\"][^'\"]\+" src/
grep -rn "PASSWORD\s*=\s*['\"][^'\"]\+" src/
grep -rn "TOKEN\s*=\s*['\"][^'\"]\+" src/
grep -rn "(sk-|pk_live_|ghp_|AKIAI)[a-zA-Z0-9]" src/

SEC-02 — localStorage Token Storage

grep -rn "localStorage.setItem.*[Tt]oken\|localStorage.setItem.*[Kk]ey" src/
grep -rn "sessionStorage.setItem.*[Tt]oken" src/

SEC-03 — SQL Injection

grep -rn "query(\`\|query(\"" src/ | grep -v "parameterized\|prepared"
grep -rn "SELECT.*\${.*}\|INSERT.*\${.*}\|WHERE.*\+" src/

SEC-04 — XSS Vectors

grep -rn "dangerouslySetInnerHTML" src/
grep -rn "innerHTML\s*=" src/
grep -rn "document.write(" src/

SEC-05 — eval() / exec()

grep -rn "\beval\b\|new Function(" src/
grep -rn "subprocess.*shell=True" src/
grep -rn "exec(.*req\|exec(.*input\|exec(.*param" src/

SEC-06 — CORS Wildcard

grep -rn "Access-Control-Allow-Origin.*\*" src/
grep -rn "origin.*\*\|cors.*origin.*true" src/

SEC-07 — Auth Bypass Risk

# Routes without auth middleware
grep -rn "router\.\(get\|post\|put\|delete\)" src/api/ | grep -v "auth\|middleware\|protect"

(Requires context analysis — sonnet reviews findings)

SEC-08 — IDOR Risk

# Resource access without ownership check
grep -rn "findById\|getById\|findOne" src/ | grep -v "userId\|ownerId\|where.*user"

(Requires context analysis)

SEC-09 — Unvalidated Input

# API endpoints without input validation
grep -rn "req\.body\|req\.params\|req\.query" src/api/ | grep -v "zod\|validate\|parse\|schema"

SEC-10 — Insecure Randomness

grep -rn "Math.random()\|random.random()" src/ | grep -vi "test\|spec\|mock"