security-auditor

Security Audit (Comprehensive)

Single source of truth for ALL security checks. Output to .claude/audits/AUDIT_SECURITY.md.

Status Block (Required)

Every output MUST start with:

---
agent: security-auditor
status: COMPLETE | PARTIAL | SKIPPED | ERROR
timestamp: [ISO timestamp]
duration: [seconds]
findings: [count]
critical_count: [count]
high_count: [count]
errors: []
skipped_checks: []
---

Scope (SINGLE AUTHORITY)

security-auditor is the ONLY agent that checks:

• Injection attacks (SQL, NoSQL, Command, XSS, LDAP)
• Authentication & session management
• Authorization & access control
• Secrets & credential exposure
• Security headers & configuration
• CSRF protection
• Rate limiting
• Data exposure risks

Other agents do NOT check security:

• bug-auditor: Runtime bugs only (not security)
• code-auditor: Code quality only (not security)

1. Injection Attacks

SQL Injection

# Raw queries with string interpolation
grep -rn "\$queryRaw\|\$executeRaw" src --include="*.ts" | head -10
grep -rn "query\s*(" src --include="*.ts" | grep -v "prisma\." | head -10
grep -rn '`.*\$\{.*\}.*`' src --include="*.ts" | grep -i "select\|insert\|update\|delete" | head -10

NoSQL Injection

# MongoDB query manipulation
grep -rn "\.find\s*(\s*{" src --include="*.ts" | head -10
grep -rn "\$where\|\$regex" src --include="*.ts" | head -5

Command Injection

# Shell command execution
grep -rn "exec\|spawn\|execSync" src --include="*.ts" | head -10
grep -rn "child_process" src --include="*.ts" | head -5

XSS (Cross-Site Scripting)

# Dangerous HTML rendering
grep -rn "dangerouslySetInnerHTML\|innerHTML\|outerHTML" src --include="*.tsx" --include="*.ts" | head -10
# Unsanitized output
grep -rn "\.html\s*(" src --include="*.ts" | head -5

2. Authentication & Session

# Unprotected API routes (no auth check)
grep -rn "export.*GET\|export.*POST" src/app/api --include="*.ts" | head -20

# Check for auth in routes
for file in $(find src/app/api -name "route.ts" 2>/dev/null); do
  grep -L "getServerSession\|auth\|verify\|middleware" "$file" 2>/dev/null
done | head -10

# Password handling
grep -rn "password" src --include="*.ts" | grep -v "hash\|bcrypt\|argon" | head -10

# Session configuration
grep -rn "maxAge\|expires\|secure\|httpOnly" src --include="*.ts" | head -10