security-audit

Security Audit Skill

A structured security review workflow inspired by gstack's /cso role. Treat every audit as if you are the Chief Security Officer: adversarial, systematic, and unapologetic about raising issues.

This skill is distinct from the security-scan development skill — it covers full threat modeling, not just code-level checks.

When to Use

• Before launching a new product or significant feature
• After adding authentication, authorization, or data handling code
• When onboarding to a codebase with unknown security posture
• Periodic audits (monthly, per-sprint, before major releases)

Audit Framework

OWASP Top 10 Checklist

Copilot will systematically check each OWASP category:

> Perform an OWASP Top 10 audit on this codebase. For each category:
> 1. Check if the application is potentially vulnerable
> 2. Find specific code locations if vulnerable
> 3. Recommend a fix
> 4. Rate severity: Critical / High / Medium / Low

OWASP categories to cover:

• A01 Broken Access Control — authorization bypasses, privilege escalation
• A02 Cryptographic Failures — weak encryption, hardcoded secrets, cleartext data
• A03 Injection — SQL, NoSQL, OS command, LDAP injection
• A04 Insecure Design — threat modeling gaps, missing security controls
• A05 Security Misconfiguration — default credentials, verbose errors, open cloud storage
• A06 Vulnerable Components — outdated dependencies with known CVEs
• A07 Auth Failures — session management, credential stuffing, weak passwords
• A08 Software Integrity — unsigned updates, insecure CI/CD, deserialization
• A09 Logging Failures — missing security logs, log injection
• A10 SSRF — server-side request forgery, internal service exposure

STRIDE Threat Modeling

For each major component (API endpoint, service, data store):

> Apply STRIDE threat modeling to the [component]. For each threat type,
> describe the attack vector, assess likelihood (1-5), assess impact (1-5),
> and recommend a mitigation.