security-audit

Security Audit (change-scoped)

Overview

Use this skill to perform a focused, diff-driven security review for an MCP Runtime change. Combine manual threat review with the repository's existing scanners, and keep findings grounded in concrete file and line references.

If the user asks for a deep, platform-wide audit, switch to security-audit-platform. For SBOM, signed images, GitHub Actions, or dependency-only work, use supply-chain-audit. For RBAC, Pod Security Standards, NetworkPolicy, and manifest hygiene, use k8s-hardening-audit.

Workflow

1. Define the security boundary.

   • Inspect git status --short, git diff --stat, and diffs for touched files.
   • Identify whether the change affects trust boundaries: user input, JSON/YAML parsing, HTTP handlers, auth cookies or headers, Kubernetes API calls, shell commands, image references, registry endpoints, ingress hosts, TLS material, audit events, or CI workflows.
   • Read nearby tests and existing implementations before judging a pattern unsafe.

2. Review MCP Runtime security invariants for the changed surface.

   • Secrets must come from Kubernetes Secrets, environment references, local test fixtures, or documented dev-only setup; do not hardcode real credentials or log token values. PLATFORM_ADMIN_PASSWORD is bootstrap-only and must not remain in steady-state env.
   • Admin and platform APIs must enforce the intended role, namespace, grant, session, and trust checks before mutating resources or returning sensitive data. The check is the requireRole(roleAdmin, …) wrap in each split service routes.go; absence on a mutating handler is a finding.
   • Gateway policy denies by default, scopes decisions to the rendered grant/session policy, and emits audit events for allow and deny paths without leaking credentials.
   • Public ingress and TLS changes preserve the documented registry.<domain>, mcp.<domain>, and platform.<domain> split; do not expose Grafana or Prometheus on the public platform host without an auth-aware design.
   • Registry and image changes respect dev HTTP versus production TLS behavior, image-pull-secret handling, and the single supported registry/registry-cert owner for registry/registry-tls.
   • Kubernetes manifests keep RBAC narrow, avoid privileged pods unless explicitly justified, preserve restricted pod-security labels in repo-owned namespaces, and avoid broad secret access.
   • HTML, JavaScript, logs, and API responses escape untrusted content and avoid reflecting secrets, auth headers, session cookies, JWTs, OIDC tokens, or API keys.
   • GitHub Actions and dependency changes keep actions pinned to commit SHAs, minimize token permissions, and avoid exposing repository or deploy secrets to untrusted PR code.