audit

What this skill does

# Audit Skill

## Overview

The audit skill provides comprehensive on-demand security and code quality audits for your codebase. It identifies vulnerabilities, security issues, code smells, outdated dependencies, exposed secrets, and compliance problems across all supported technology stacks.

**When to Use**:
- Security audits and vulnerability scans
- Pre-deployment security checks
- Compliance verification (GDPR, HIPAA, SOC2)
- Code quality assessment
- Dependency vulnerability scanning
- Secret exposure detection
- Third-party license compliance

**Technology Coverage**:
- React/TypeScript/JavaScript projects
- Go applications
- Rust projects
- Python codebases
- Full-stack applications
- Monorepos and microservices

## Audit Categories

### 1. Security Vulnerabilities (OWASP Top 10)

**What Gets Checked**:
- SQL injection vulnerabilities
- Cross-site scripting (XSS)
- Authentication and session management flaws
- Security misconfigurations
- Sensitive data exposure
- XML external entities (XXE)
- Broken access control
- Cross-site request forgery (CSRF)
- Using components with known vulnerabilities
- Insufficient logging and monitoring

**Detection Methods**:
- Static code analysis
- Pattern matching for common vulnerabilities
- Framework-specific security checks
- API endpoint security validation
- Input validation analysis

### 2. Dependency Vulnerabilities

**What Gets Checked**:
- Outdated packages with known CVEs
- Unmaintained dependencies
- License compatibility issues
- Transitive dependency risks
- Version conflicts

**Package Managers Supported**:
- npm/yarn/pnpm (JavaScript/TypeScript)
- go.mod (Go)
- Cargo.toml (Rust)
- requirements.txt/pyproject.toml (Python)
- Gemfile (Ruby)

**Tools Used**:
- `npm audit` / `yarn audit` / `pnpm audit`
- `go mod verify` + vulnerability databases
- `cargo audit`
- `pip-audit` / `safety`

### 3. Exposed Secrets and Credentials

**What Gets Detected**:
- Hardcoded API keys and tokens
- Database credentials
- Private keys and certificates
- OAuth tokens and secrets
- AWS/GCP/Azure credentials
- JWT secrets
- Encryption keys

**Detection Patterns**:
- Regex patterns for common secret formats
- Environment variable misuse
- Configuration file analysis
- Git history scanning (if requested)
- Common secret naming patterns

**False Positive Reduction**:
- Ignore test fixtures and mocks
- Respect `.gitignore` patterns
- Check for proper environment variable usage
- Validate against `.env.example` templates

### 4. Code Quality Issues

**What Gets Analyzed**:
- Code complexity (cyclomatic complexity)
- Code duplication
- Dead code and unused exports
- Large functions and files
- Naming convention violations
- Magic numbers and hardcoded values
- Lack of error handling
- Poor separation of concerns

**Metrics Calculated**:
- Cyclomatic complexity per function
- Duplication percentage
- Lines of code (LOC) per file/function
- Comment-to-code ratio
- Test-to-code ratio

## Running Audits

### Full Audit

Run all audit categories:

```
Please run a full security and quality audit of this codebase
```

The audit will:
1. Scan all source files for vulnerabilities
2. Check dependencies for known CVEs
3. Search for exposed secrets
4. Analyze code quality metrics
5. Generate comprehensive report

### Category-Specific Audits

**Security Only**:
```
Run a security audit focusing on OWASP top 10 vulnerabilities
```

**Dependencies Only**:
```
Audit all dependencies for vulnerabilities and outdated packages
```

**Secrets Only**:
```
Scan for exposed secrets and credentials
```

**Code Quality Only**:
```
Analyze code quality and identify code smells
```

### Targeted Audits

**Specific Directory**:
```
Audit the /src/auth directory for security issues
```

**Specific Files**:
```
Audit UserController.ts and AuthService.ts for vulnerabilities
```

**Pre-Deployment**:
```
Run pre-deployment audit checklist
```

## Audit Report Format

### Severity Levels

Reports classify findings by severity:

- **CRITICAL**: Immediate security risk, exploitable vulnerability
- **HIGH**: Significant security or quality issue
- **MEDIUM**: Moderate issue that should be addressed
- **LOW**: Minor issue or code smell
- **INFO**: Informational finding, best practice suggestion

### Report Structure

```markdown
# Security and Quality Audit Report

**Generated**: 2026-01-28 14:32:00
**Scope**: Full codebase audit
**Files Scanned**: 247
**Duration**: 8.3 seconds

## Executive Summary

- CRITICAL: 2 findings
- HIGH: 5 findings
- MEDIUM: 12 findings
- LOW: 23 findings
- INFO: 8 findings

**Risk Score**: 7.2/10 (HIGH)

## Critical Findings

### [CRITICAL-001] SQL Injection Vulnerability
**File**: src/database/queries.ts:42
**Severity**: CRITICAL
**Category**: Security - SQL Injection

**Issue**: User input concatenated directly into SQL query without sanitization.

**Code**:
```typescript
const query = `SELECT * FROM users WHERE email = '${email}'`;
```

**Impact**: Attacker can execute arbitrary SQL commands.

**Recommendation**: Use parameterized queries or ORM.

**Fix**:
```typescript
const query = db.prepare('SELECT * FROM users WHERE email = ?').bind(email);
```

---

### [CRITICAL-002] Exposed API Key
**File**: src/config/api.ts:15
**Severity**: CRITICAL
**Category**: Security - Exposed Secret

**Issue**: Hardcoded API key found in source code.

**Code**:
```typescript
const STRIPE_SECRET_KEY = "sk_live_abc123xyz789";
```

**Impact**: Unauthorized access to Stripe account.

**Recommendation**: Move to environment variable.

**Fix**:
```typescript
const STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY;
```

## High Priority Findings

### [HIGH-001] Outdated Dependency with Known CVE
**File**: package.json:23
**Severity**: HIGH
**Category**: Dependencies

**Issue**: [email protected] has known vulnerability (CVE-2021-23337)

**CVE Details**:
- CVE-2021-23337: Command injection in template
- Published: 2021-02-15
- CVSS Score: 7.2

**Recommendation**: Upgrade to [email protected] or higher

**Fix**:
```bash
npm install lodash@latest
```

[... additional findings ...]

## Compliance Checks

### OWASP Top 10 Coverage
- [FAIL] A1: Injection - 2 SQL injection vulnerabilities found
- [PASS] A2: Broken Authentication
- [FAIL] A3: Sensitive Data Exposure - 1 exposed secret
- [PASS] A4: XML External Entities
- [PASS] A5: Broken Access Control
- [FAIL] A6: Security Misconfiguration - CORS too permissive
- [PASS] A7: Cross-Site Scripting
- [PASS] A8: Insecure Deserialization
- [FAIL] A9: Using Components with Known Vulnerabilities - 3 outdated deps
- [WARN] A10: Insufficient Logging - Limited audit logging

**Overall**: 6/10 passing (60%)

## Recommendations

1. **Immediate Actions** (CRITICAL/HIGH):
   - Fix SQL injection in queries.ts
   - Remove hardcoded API key
   - Upgrade vulnerable dependencies

2. **Short Term** (MEDIUM):
   - Improve error handling consistency
   - Add input validation to all API endpoints
   - Configure stricter CORS policy

3. **Long Term** (LOW/INFO):
   - Reduce code duplication (12% current)
   - Refactor complex functions (8 functions >15 complexity)
   - Improve test coverage (currently 67%)
```

## Integration with Dev Plugin

### With Code Analysis Agent

Use code-analysis enrichment before audit:

```
First enrich the codebase with claudemem, then run security audit
```

This provides:
- Context-aware vulnerability detection
- Better false positive filtering
- Dependency graph analysis

### With Test Architect Agent

Combine audit with test coverage:

```
Run audit and identify untested critical code paths
```

### With Optimize Skill

Security-performance trade-offs:

```
Audit security implications of performance optimizations
```

## Best Practices

### 1. Regular Audits

**Recommended Schedule**:
- Daily: Dependency vulnerability scans (CI/CD)
- Weekly: Full security audit
- Pre-deployment: Comprehensive audit
- Post-incident: Targeted security review

### 2. Incremental Audits

For large codebases:

```
Audit files