{"id":"48b4006f-6e88-4021-83a2-a895c9640af0","shortId":"KnjLtb","kind":"skill","title":"security-auditor","tagline":"Use when reviewing authentication, authorization, user input, secrets, API keys, database queries, file uploads, session management, external API calls, OWASP risks, or data handling attack surface.","description":"# Security Auditor\n\nA security-focused reviewer that evaluates code for vulnerabilities, insecure patterns, and data handling risks. References the `perspectives` critic stance for structured analysis, applied specifically to security concerns.\n\n## Dispatch\n\nCan be dispatched as a subagent by code-review or flow-review workflows when changes touch security-sensitive areas.\n\n## Direct Invocation\n\n- \"Security audit this authentication flow\"\n- \"Review this for OWASP vulnerabilities\"\n- \"Check this input handling for injection risks\"\n- \"Audit the data handling in this endpoint\"\n\n<workflow>\n\n## Workflow\n\n### Step 1: Apply Persona\n\nThink like an attacker to find exploitable weaknesses, then like a defender for fixes. Severity classification:\n\n- **Critical** — Exploitable now, no preconditions or easily-met ones. Immediate fix required.\n- **High** — Exploitable with effort or specific conditions. Fix before shipping.\n- **Medium** — Defense-in-depth gap. Doesn't enable direct exploitation but reduces cost of other attacks. Fix next iteration.\n- **Low** — Hardening improvement. More robust but no meaningful standalone risk. Fix when convenient.\n\n### Step 2: OWASP Checklist\n\nWork through each category (acknowledge secure categories briefly):\n\n1. **Injection** (SQL, command, XSS) — Is user input sanitized? Are parameterized queries used? Is output encoded for the appropriate context?\n2. **Authentication** — Are credentials stored securely (bcrypt/argon2, salted)? Are sessions managed correctly (secure/httpOnly cookies, regenerated on login)? Brute-force protections in place?\n3. **Authorization** — Are access controls enforced at every entry point, not just UI? Can users escalate via ID manipulation (IDOR)? Are object-level permissions checked?\n4. **Data exposure** — Are secrets hardcoded or committed to version control? Are sensitive fields (passwords, tokens, PII) appearing in logs? Is PII minimized and encrypted at rest?\n5. **Input validation** — Is all external input validated at system boundaries? Are type, length, and format constraints enforced? Are file uploads validated for type and content?\n6. **Configuration** — Are default credentials changed? Debug endpoints disabled in production? CORS policies restrictive? Security headers present (CSP, HSTS, X-Frame-Options)?\n7. **Dependencies** — Known-vulnerable versions in use? Versions pinned (not floating ranges in production)? Unmaintained dependencies?\n8. **Cryptography** — Strong algorithms (AES-256, SHA-256+, RSA-2048+, no MD5/SHA-1)? Key rotation? TLS enforced? CSPRNG for security-sensitive random values?\n\n### Step 3: Report Findings\n\nFor each finding: OWASP category, severity, realistic attack vector, fix. Categories with no findings acknowledged briefly as secure.\n\n</workflow>\n\n<guardrails>\n\n## Guardrails\n\n- Findings must have realistic attack vectors, not theoretical ones requiring impossible preconditions\n- Severity must be justified by actual exploitability, not theoretical purity\n- Focus on what can actually be exploited given the system context\n- Acknowledge when code is secure — thorough input validation and correct auth implementation deserve a note\n\n</guardrails>\n\n<validation>\n\n### Validation Checkpoint\n\nBefore delivering findings, verify:\n\n- [ ] Every finding has a realistic attack vector (not theoretical)\n- [ ] Severity justified by actual exploitability\n- [ ] Fixes are actionable and specific\n- [ ] Categories with no findings briefly acknowledged as secure\n\n</validation>\n\n<example>\n\n## Example\n\n**Context:** Security audit of a user lookup API endpoint.\n\n**Finding 1 — Injection (SQL) — Severity: Critical**\n`db.query(\"SELECT * FROM users WHERE id = \" + req.params.id)` concatenates user input directly into SQL. Attack vector: `GET /users/1;DROP TABLE users--` executes arbitrary SQL. Fix: use parameterized query `db.query(\"SELECT * FROM users WHERE id = $1\", [req.params.id])`.\n\n**Finding 2 — Data Exposure — Severity: High**\nError handler returns full stack trace in production response body: `res.json({ error: err.stack })`. Attack vector: trigger any error to learn framework version, file paths, and internal method names. Fix: return generic error to client, log stack trace server-side only.\n\n**Finding 3 — Authorization — Severity: High**\nEndpoint checks `req.user.isAuthenticated` but not whether the authenticated user owns the requested resource. Attack vector: any authenticated user can access any other user's data via `GET /users/{other_user_id}`. Fix: add `req.user.id === req.params.id` check or implement object-level permission middleware.\n\n**Secure categories:** Authentication (bcrypt with salt, session regeneration on login), Input validation (express-validator with type/length constraints on all parameters), Dependencies (all pinned, no known CVEs).\n\n</example>\n\n## References Index\n\n- **[Persona](references/persona.md)** — Role, approach, scope, severity classification, and guardrails\n- **[Security Checklist](references/checklist.md)** — Eight OWASP-informed review categories\n- **[Critic Stance](../perspectives/references/stances.md)** — Underlying stance prompt with ethical guardrails (from perspectives skill)","tags":["security","auditor","flow","cofin","agent-skills","ai-agents","beads","claude-code","codex","cursor","developer-tools","gemini-cli"],"capabilities":["skill","source-cofin","skill-security-auditor","topic-agent-skills","topic-ai-agents","topic-beads","topic-claude-code","topic-codex","topic-cursor","topic-developer-tools","topic-gemini-cli","topic-opencode","topic-plugin","topic-slash-commands","topic-spec-driven-development"],"categories":["flow"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/cofin/flow/security-auditor","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add cofin/flow","source_repo":"https://github.com/cofin/flow","install_from":"skills.sh"}},"qualityScore":"0.455","qualityRationale":"deterministic score 0.46 from registry signals: · indexed on github topic:agent-skills · 11 github stars · SKILL.md body (5,170 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T19:07:39.328Z","embedding":null,"createdAt":"2026-04-23T13:04:01.512Z","updatedAt":"2026-05-18T19:07:39.328Z","lastSeenAt":"2026-05-18T19:07:39.328Z","tsv":"'-2048':370 '-256':366,368 '/perspectives/references/stances.md':683 '/users':618 '/users/1':520 '1':112,199,499,537 '2':188,219,540 '3':242,385,587 '4':268 '5':295 '6':321 '7':344 '8':361 'access':245,610 'acknowledg':195,402,440,485 'action':477 'actual':424,433,473 'add':623 'ae':365 'algorithm':364 'analysi':55 'api':12,21,496 'appear':285 'appli':56,113 'approach':666 'appropri':217 'arbitrari':525 'area':83 'attack':28,118,170,395,411,466,517,558,604 'audit':87,103,491 'auditor':3,31 'auth':450 'authent':7,89,220,598,607,636 'author':8,243,588 'bcrypt':637 'bcrypt/argon2':225 'bodi':554 'boundari':305 'briefli':198,403,484 'brute':237 'brute-forc':236 'call':22 'categori':194,197,392,398,480,635,680 'chang':78,326 'check':96,267,592,626 'checklist':190,673 'checkpoint':456 'classif':130,669 'client':578 'code':39,70,442 'code-review':69 'command':202 'commit':275 'concaten':511 'concern':60 'condit':150 'configur':322 'constraint':311,651 'content':320 'context':218,439,489 'control':246,278 'conveni':186 'cooki':232 'cor':332 'correct':230,449 'cost':167 'credenti':222,325 'critic':51,131,503,681 'cryptographi':362 'csp':338 'csprng':377 'cves':660 'data':26,45,105,269,541,615 'databas':14 'db.query':504,531 'debug':327 'default':324 'defend':126 'defens':156 'defense-in-depth':155 'deliv':458 'depend':345,360,655 'depth':158 'deserv':452 'direct':84,163,514 'disabl':329 'dispatch':61,64 'doesn':160 'drop':521 'easili':138 'easily-met':137 'effort':147 'eight':675 'enabl':162 'encod':214 'encrypt':292 'endpoint':109,328,497,591 'enforc':247,312,376 'entri':250 'err.stack':557 'error':545,556,562,576 'escal':257 'ethic':688 'evalu':38 'everi':249,461 'exampl':488 'execut':524 'exploit':121,132,145,164,425,435,474 'exposur':270,542 'express':647 'express-valid':646 'extern':20,300 'field':281 'file':16,314,567 'find':120,387,390,401,407,459,462,483,498,539,586 'fix':128,142,151,171,184,397,475,527,573,622 'float':355 'flow':74,90 'flow-review':73 'focus':35,429 'forc':238 'format':310 'frame':342 'framework':565 'full':548 'gap':159 'generic':575 'get':519,617 'given':436 'guardrail':406,671,689 'handl':27,46,99,106 'handler':546 'hardcod':273 'harden':175 'header':336 'high':144,544,590 'hsts':339 'id':259,509,536,621 'idor':261 'immedi':141 'implement':451,628 'imposs':417 'improv':176 'index':662 'inform':678 'inject':101,200,500 'input':10,98,206,296,301,446,513,644 'insecur':42 'intern':570 'invoc':85 'iter':173 'justifi':422,471 'key':13,373 'known':347,659 'known-vulner':346 'learn':564 'length':308 'level':265,631 'like':116,124 'log':287,579 'login':235,643 'lookup':495 'low':174 'manag':19,229 'manipul':260 'md5/sha-1':372 'meaning':181 'medium':154 'met':139 'method':571 'middlewar':633 'minim':290 'must':408,420 'name':572 'next':172 'note':454 'object':264,630 'object-level':263,629 'one':140,415 'option':343 'output':213 'owasp':23,94,189,391,677 'owasp-inform':676 'own':600 'paramet':654 'parameter':209,529 'password':282 'path':568 'pattern':43 'permiss':266,632 'persona':114,663 'perspect':50,691 'pii':284,289 'pin':353,657 'place':241 'point':251 'polici':333 'precondit':135,418 'present':337 'product':331,358,552 'prompt':686 'protect':239 'puriti':428 'queri':15,210,530 'random':382 'rang':356 'realist':394,410,465 'reduc':166 'refer':48,661 'references/checklist.md':674 'references/persona.md':664 'regener':233,641 'report':386 'req.params.id':510,538,625 'req.user.id':624 'req.user.isauthenticated':593 'request':602 'requir':143,416 'res.json':555 'resourc':603 'respons':553 'rest':294 'restrict':334 'return':547,574 'review':6,36,71,75,91,679 'risk':24,47,102,183 'robust':178 'role':665 'rotat':374 'rsa':369 'salt':226,639 'sanit':207 'scope':667 'secret':11,272 'secur':2,30,34,59,81,86,196,224,335,380,405,444,487,490,634,672 'secure/httponly':231 'security-auditor':1 'security-focus':33 'security-sensit':80,379 'select':505,532 'sensit':82,280,381 'server':583 'server-sid':582 'session':18,228,640 'sever':129,393,419,470,502,543,589,668 'sha':367 'ship':153 'side':584 'skill':692 'skill-security-auditor' 'source-cofin' 'specif':57,149,479 'sql':201,501,516,526 'stack':549,580 'stanc':52,682,685 'standalon':182 'step':111,187,384 'store':223 'strong':363 'structur':54 'subag':67 'surfac':29 'system':304,438 'tabl':522 'theoret':414,427,469 'think':115 'thorough':445 'tls':375 'token':283 'topic-agent-skills' 'topic-ai-agents' 'topic-beads' 'topic-claude-code' 'topic-codex' 'topic-cursor' 'topic-developer-tools' 'topic-gemini-cli' 'topic-opencode' 'topic-plugin' 'topic-slash-commands' 'topic-spec-driven-development' 'touch':79 'trace':550,581 'trigger':560 'type':307,318 'type/length':650 'ui':254 'under':684 'unmaintain':359 'upload':17,315 'use':4,211,351,528 'user':9,205,256,494,507,512,523,534,599,608,613,620 'valid':297,302,316,447,455,645,648 'valu':383 'vector':396,412,467,518,559,605 'verifi':460 'version':277,349,352,566 'via':258,616 'vulner':41,95,348 'weak':122 'whether':596 'work':191 'workflow':76,110 'x':341 'x-frame-opt':340 'xss':203","prices":[{"id":"f6dea815-0ccf-4af2-bc4b-200991baaeb9","listingId":"48b4006f-6e88-4021-83a2-a895c9640af0","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"cofin","category":"flow","install_from":"skills.sh"},"createdAt":"2026-04-23T13:04:01.512Z"}],"sources":[{"listingId":"48b4006f-6e88-4021-83a2-a895c9640af0","source":"github","sourceId":"cofin/flow/security-auditor","sourceUrl":"https://github.com/cofin/flow/tree/main/skills/security-auditor","isPrimary":false,"firstSeenAt":"2026-04-23T13:04:01.512Z","lastSeenAt":"2026-05-18T19:07:39.328Z"}],"details":{"listingId":"48b4006f-6e88-4021-83a2-a895c9640af0","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"cofin","slug":"security-auditor","github":{"repo":"cofin/flow","stars":11,"topics":["agent-skills","ai-agents","beads","claude-code","codex","context-driven-development","cursor","developer-tools","gemini-cli","opencode","plugin","slash-commands","spec-driven-development","subagents","tdd","workflow"],"license":"apache-2.0","html_url":"https://github.com/cofin/flow","pushed_at":"2026-04-27T19:07:26Z","description":"Context-Driven Development toolkit for AI agents — spec-first planning, TDD workflow, and Beads integration.","skill_md_sha":"a705e28362bec01a7717900b5ea4b9dfc1cd77ab","skill_md_path":"skills/security-auditor/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/cofin/flow/tree/main/skills/security-auditor"},"layout":"multi","source":"github","category":"flow","frontmatter":{"name":"security-auditor","description":"Use when reviewing authentication, authorization, user input, secrets, API keys, database queries, file uploads, session management, external API calls, OWASP risks, or data handling attack surface."},"skills_sh_url":"https://skills.sh/cofin/flow/security-auditor"},"updatedAt":"2026-05-18T19:07:39.328Z"}}