velocity.report: Skill for Claude Code

Skill: security-review

Run a structured security review. Produces severity-rated findings with exploit steps, impact, and remediation. Uses Malory's methodology.

Usage

/security-review
/security-review internal/api/
/security-review internal/lidar/
/security-review internal/report/
/security-review all

Without an argument, reviews all changed files (from git diff --stat).

Procedure

1. Identify scope

If a path or area is given, focus there. Otherwise:

git diff --stat HEAD
git diff --name-only HEAD

Identify which subsystems are touched: radar, lidar, API, PDF generator, web, config.

2. Static analysis pass

Work through subsystems in priority order:

1. Input parsing functions: highest risk
2. Database operations
3. File I/O
4. Network handlers
5. Config parsing

For each area, check:

• Input validation: high-risk parse points include radar JSON parsing (internal/radar/), LiDAR UDP packet parsing (internal/lidar/), serial command handling, API request bodies (oversized payloads, malformed JSON, path traversal), config file parsing. Test mentally with: overflows, negatives, special characters, null bytes, UTF-8 edge cases, injection payloads.
• Auth & access: is API authentication implemented and enforced on every route? Are privilege levels checked? Can an unauthenticated user reach sensor data? Are default credentials present?
• Privacy guarantees: verify these claims hold (they are the project's core promise):
  • No licence plate data collected
  • No camera/video recording
  • No PII in database
  • Data stays local
  • Then look for what the claims don't cover: timing-based vehicle re-identification, metadata leakage (sensor location in exports), PII in debug logs or error messages, data correlation with external sources.
• Code execution vectors: Typst/template-data injection in PDF generation, shell commands in scripts, deserialisation, template injection, local privilege escalation via systemd misconfig, suid binaries, file permission gaps.
• Denial of service: API request flooding, large payloads, database disk exhaustion, memory exhaustion via sensor data streams, CPU-heavy queries, crash paths via malformed sensor data, invalid queries, null derefs, uncaught panics.