security-scanner

Security Scanner

Comprehensive security analysis detecting hardcoded secrets, SQL injection, XSS, insecure dependencies, and OWASP Top 10 vulnerabilities.

What This Skill Does

• Scans for hardcoded secrets (API keys, passwords, tokens)
• Detects SQL injection vulnerabilities
• Finds XSS attack vectors
• Checks insecure dependencies
• Identifies authentication/authorization flaws
• Reviews CORS and CSP configurations
• Checks for insecure cryptography

Instructions

Phase 1: Secret Detection

Search for common secret patterns:

# API Keys
Grep for patterns:
- AWS: AKIA[0-9A-Z]{16}
- GitHub: ghp_[0-9a-zA-Z]{36}
- Slack: xox[baprs]-[0-9]{10,13}-[0-9a-zA-Z]{24,}
- Stripe: sk_live_[0-9a-zA-Z]{24}
- Private keys: -----BEGIN.*PRIVATE KEY-----

# Passwords
- password\s*=\s*["'][^"']+["']
- DB connection strings
- Hardcoded credentials

Example findings:

HIGH: Hardcoded AWS key found
File: src/config.js:12
Pattern: const AWS_KEY = "AKIAIOSFODNN7EXAMPLE"
Risk: Exposed AWS credentials
Fix: Use environment variables or secrets manager

Phase 2: Injection Vulnerabilities

SQL Injection:

# BAD: String concatenation
query = "SELECT * FROM users WHERE id = " + user_id

# GOOD: Parameterized query
query = "SELECT * FROM users WHERE id = ?"

Command Injection:

// BAD: Direct execution
exec(`ls ${userInput}`)

// GOOD: Sanitized input
execFile('ls', [sanitize(userInput)])

XSS Detection:

// BAD: innerHTML with user input
element.innerHTML = userInput

// GOOD: textContent or sanitize
element.textContent = userInput
// Or use DOMPurify
element.innerHTML = DOMPurify.sanitize(userInput)

Phase 3: Dependency Vulnerabilities

# Check for vulnerable dependencies
npm audit
pip-audit
cargo audit

# Generate report
npm audit --json > audit-report.json

Phase 4: OWASP Top 10 Checks

1. Broken Access Control
   • Missing authorization checks
   • Insecure direct object references
   • Exposed admin endpoints