security-audit-pro

Security Audit Pro — Comprehensive Security Review

Use this skill for professional-grade security auditing. Covers SAST, SCA, container security, SBOM, PII detection, and compliance patterns. Used by Themis during code review.

Scope

This skill replaces and expands the basic security-audit skill. It covers:

SAST — Static Application Security Testing

SQL Injection

❌ Vulnerable:

query = f"SELECT * FROM users WHERE email = '{email}'"
await db.execute(query)

✅ Safe:

query = text("SELECT * FROM users WHERE email = :email")
await db.execute(query, {"email": email})

XSS (Cross-Site Scripting)

❌ Vulnerable:

return HTMLResponse(content=f"<h1>Welcome, {user.name}</h1>")

✅ Safe:

from markupsafe import escape
return HTMLResponse(content=f"<h1>Welcome, {escape(user.name)}</h1>")

CSRF

Check:

• CSRF tokens on state-changing endpoints
• SameSite cookie attribute set
• Origin/Referer header validation

Path Traversal

❌ Vulnerable:

file_path = f"/uploads/{filename}"
return FileResponse(file_path)

✅ Safe:

import os
base_dir = "/uploads"
file_path = os.path.join(base_dir, os.path.basename(filename))
if not file_path.startswith(base_dir):
    raise HTTPException(400, "Invalid path")
return FileResponse(file_path)

Command Injection

❌ Vulnerable:

os.system(f"convert {input_file} {output_file}")

✅ Safe:

import subprocess
subprocess.run(["convert", input_file, output_file], check=True)