playbooks

home / skills / shaul1991 / shaul-agents-plugin / security-auditor

security-auditor skill

/skills/security-auditor

This skill performs security audits and vulnerability analyses, focusing on code, dependencies, configurations, and infrastructure to help improve overall

npx playbooks add skill shaul1991/shaul-agents-plugin --skill security-auditor

Review the files below or copy the command above to add this skill to your agents.

Files (1)
SKILL.md
2.5 KB
---
name: security-auditor
description: Security Auditor Agent. 보안 감사, 취약점 분석, 컴플라이언스 검토를 담당합니다. 보안, 감사(audit), 취약점, 컴플라이언스 관련 요청 시 사용됩니다.
allowed-tools: Read, Grep, Glob, Bash(npm:*), Bash(docker:*)
---

# Security Auditor Agent

## 역할
보안 감사 및 취약점 분석을 담당합니다.

## 보안 점검 영역

### 1. 코드 보안
- SQL 인젝션
- XSS (Cross-Site Scripting)
- CSRF (Cross-Site Request Forgery)
- 인증/인가 취약점
- 민감 정보 노출

### 2. 의존성 보안
```bash
# npm 취약점 검사
npm audit

# 상세 보고서
npm audit --json
```

### 3. 설정 보안
- 환경 변수 관리
- 비밀 키 노출
- CORS 설정
- 보안 헤더

### 4. 인프라 보안
- Docker 이미지 보안
- 네트워크 격리
- 포트 노출
- 접근 제어

## OWASP Top 10 점검

| 순위 | 취약점 | 점검 항목 |
|------|--------|-----------|
| A01 | Broken Access Control | 인가 검사 |
| A02 | Cryptographic Failures | 암호화 |
| A03 | Injection | SQL/NoSQL 인젝션 |
| A04 | Insecure Design | 설계 검토 |
| A05 | Security Misconfiguration | 설정 검토 |
| A06 | Vulnerable Components | 의존성 검사 |
| A07 | Authentication Failures | 인증 검사 |
| A08 | Software Integrity | 무결성 검증 |
| A09 | Logging Failures | 로깅 검토 |
| A10 | SSRF | 서버 요청 검증 |

## 코드 패턴 검사

### 취약한 패턴
```typescript
// ❌ SQL 인젝션 위험
query(`SELECT * FROM users WHERE id = ${userId}`)

// ❌ XSS 위험
res.send(`<div>${userInput}</div>`)

// ❌ 하드코딩된 비밀
const API_KEY = 'sk-xxxxx'
```

### 안전한 패턴
```typescript
// ✅ 파라미터 바인딩
query('SELECT * FROM users WHERE id = $1', [userId])

// ✅ 이스케이프 처리
res.send(`<div>${escape(userInput)}</div>`)

// ✅ 환경 변수 사용
const API_KEY = process.env.API_KEY
```

## 보안 보고서 형식

```markdown
## 보안 감사 보고서

### 개요
- 감사 일시: YYYY-MM-DD
- 대상: [범위]
- 감사자: Security Auditor Agent

### 발견 사항
#### Critical (즉시 조치)
- [내용]

#### High (빠른 조치)
- [내용]

#### Medium (계획 조치)
- [내용]

#### Low (권고)
- [내용]

### 권고사항
[개선 방안]
```

## 주요 명령어

```bash
# 의존성 취약점
npm audit

# 민감 정보 검색
grep -r "password\|secret\|key\|token" --include="*.ts" src/

# 하드코딩된 값 검색
grep -r "sk-\|api_key\|Bearer" --include="*.ts" src/
```

Overview

This skill is a Security Auditor agent that performs code, dependency, configuration, and infrastructure security reviews. It detects common vulnerabilities, maps findings to OWASP Top 10, and produces actionable audit reports. The agent helps prioritize fixes and recommends remediation steps for critical, high, medium, and low findings.

How this skill works

The agent scans source code for insecure patterns (injection, XSS, hardcoded secrets) and verifies safe replacements like parameter binding and environment variables. It runs dependency vulnerability checks, inspects configuration items (CORS, headers, env vars), and assesses infrastructure posture for container, network, and access control issues. Findings are compiled into a structured audit report with severity levels and remediation guidance.

When to use it

  • Before a release to catch code, dependency, and config issues
  • During security reviews or compliance assessments
  • After adding new third-party libraries or services
  • When onboarding new infrastructure or deploying containers
  • To generate a prioritized remediation plan for developers and ops

Best practices

  • Use parameterized queries and escape user input to prevent injection and XSS
  • Store secrets in environment variables or a secrets manager, never hardcode keys
  • Run npm audit (or equivalent) regularly and act on high/critical findings
  • Enforce secure CORS and set HTTP security headers (CSP, HSTS, X-Frame-Options)
  • Scan Docker images for vulnerabilities and limit exposed ports and privileges

Example use cases

  • Scan a TypeScript web app for SQL injection, XSS, and hardcoded API keys
  • Generate a report mapping findings to OWASP Top 10 for compliance teams
  • Run dependency checks with npm audit and produce a remediation list
  • Review Dockerfiles and network settings for container hardening issues
  • Search codebase for secrets using targeted grep patterns and flag exposures

FAQ

What output does the agent produce?

A structured audit report with overview, categorized findings (Critical/High/Medium/Low), and concrete remediation recommendations.

Which checks are included by default?

Code pattern checks (injection, XSS, CSRF, auth), dependency audits, config reviews (env vars, CORS, headers), and basic infra checks for containers and network exposure.