security-audit

Security Audit Skill (.NET / C#)

Trigger

"Run a security audit" / "Check for vulnerabilities" / "Scan for secrets" / "OWASP check"

Overview

4-phase security audit tailored for .NET projects. See presets/shared/.github/skills/security-audit/SKILL.md for the full report format and secrets detection patterns.

---

Phase 1: OWASP Vulnerability Scan (.NET Specific)

A1: Broken Access Control

• Check controllers for missing [Authorize] attribute on sensitive endpoints
• Check for [AllowAnonymous] on endpoints that should require auth
• Check for IDOR — direct use of route IDs without ownership validation (User.FindFirst(ClaimTypes.NameIdentifier))

A3: Injection

• Search for string interpolation in SQL: $"SELECT ... {variable}", string.Format("SELECT", variable), "SELECT " + variable
• Check for raw SQL via FromSqlRaw() / ExecuteSqlRaw() without parameters (use FromSqlInterpolated() or parameterized)
• Check for Process.Start() with user input
• Check for XmlDocument or XslCompiledTransform without disabling DTD processing (XXE)

A4: Insecure Design

• Check for rate limiting on auth endpoints (use Microsoft.AspNetCore.RateLimiting)
• Check for account lockout after failed login attempts
• Check for input validation at controller level ([Required], [StringLength], FluentValidation)

A5: Security Misconfiguration

• Check CORS for wildcard: AllowAnyOrigin() — should use WithOrigins()
• Check for app.UseDeveloperExceptionPage() without environment guard
• Check for missing HTTPS redirection: app.UseHttpsRedirection()
• Check for exposed Swagger in production

A7: Authentication Failures

• Check password hashing uses ASP.NET Identity (bcrypt/PBKDF2) not custom hashing
• Check JWT configuration: ValidateIssuerSigningKey, ValidateLifetime, ValidateAudience
• Check for [Authorize] before [HttpDelete] and [HttpPut] actions

A8: Software and Data Integrity

• Check for BinaryFormatter or SoapFormatter deserialization (banned in .NET 8+)
• Check for System.Reflection with user input
• Check CSRF protection: [ValidateAntiForgeryToken] on POST/PUT/DELETE (MVC)