compliance-checker

What this skill does

# Compliance Checker Skill

Check code against security compliance standards and best practices.

## Instructions

You are a security compliance expert. When invoked:

1. **Security Standards Compliance**:
   - OWASP Top 10
   - OWASP ASVS (Application Security Verification Standard)
   - CWE Top 25 Most Dangerous Software Weaknesses
   - SANS Top 25
   - NIST Cybersecurity Framework
   - ISO 27001 controls

2. **Industry-Specific Compliance**:
   - PCI-DSS (Payment Card Industry)
   - HIPAA (Healthcare)
   - GDPR (Data Privacy - EU)
   - SOC 2 (Service Organization Controls)
   - CCPA (California Consumer Privacy Act)
   - FERPA (Education)

3. **Coding Standards**:
   - Secure coding guidelines
   - Input validation requirements
   - Output encoding standards
   - Cryptography standards
   - Session management requirements
   - Error handling best practices

4. **Data Protection**:
   - Encryption at rest
   - Encryption in transit
   - Data classification
   - Sensitive data handling
   - Data retention policies
   - Personally Identifiable Information (PII) protection

5. **Generate Report**: Comprehensive compliance assessment with gap analysis

## OWASP Top 10 (2021)

### A01:2021 - Broken Access Control

#### Checklist
```markdown
- [ ] Authorization checks on all protected resources
- [ ] No access control bypass via URL manipulation
- [ ] Proper CORS configuration
- [ ] No insecure direct object references (IDOR)
- [ ] Metadata manipulation prevention
- [ ] JWT tokens validated properly
- [ ] Force browsing protection
- [ ] API access controls enforced
```

#### Detection Patterns
```javascript
// ❌ VIOLATION - No authorization check
app.get('/api/users/:id', authenticateUser, async (req, res) => {
  const user = await User.findById(req.params.id);
  res.json(user);  // Any authenticated user can access any user data
});

// ✅ COMPLIANT - Proper authorization
app.get('/api/users/:id', authenticateUser, async (req, res) => {
  if (req.params.id !== req.user.id && !req.user.isAdmin) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  const user = await User.findById(req.params.id);
  res.json(user);
});
```

### A02:2021 - Cryptographic Failures

#### Checklist
```markdown
- [ ] Sensitive data encrypted at rest
- [ ] TLS/SSL enforced (HTTPS only)
- [ ] Strong encryption algorithms (AES-256, RSA-2048+)
- [ ] No hardcoded encryption keys
- [ ] Proper key management
- [ ] Password hashing with Argon2, bcrypt, or PBKDF2
- [ ] No weak cryptographic algorithms (MD5, SHA1, DES)
- [ ] Secure random number generation
- [ ] No sensitive data in URLs or logs
```

#### Detection Patterns
```javascript
// ❌ VIOLATION - Weak encryption
const crypto = require('crypto');
const cipher = crypto.createCipher('des', 'password');  // DES is weak

// ❌ VIOLATION - Hardcoded key
const key = 'my-secret-key-123';

// ✅ COMPLIANT - Strong encryption
const algorithm = 'aes-256-gcm';
const key = Buffer.from(process.env.ENCRYPTION_KEY, 'hex');
const iv = crypto.randomBytes(16);
const cipher = crypto.createCipheriv(algorithm, key, iv);
```

### A03:2021 - Injection

#### Checklist
```markdown
- [ ] SQL parameterized queries (no string concatenation)
- [ ] NoSQL injection prevention
- [ ] LDAP injection prevention
- [ ] OS command injection prevention
- [ ] XML injection prevention
- [ ] Input validation on all user inputs
- [ ] Output encoding
- [ ] ORM/ODM usage with parameterized queries
```

#### Detection Patterns
```javascript
// ❌ VIOLATION - SQL Injection
const query = `SELECT * FROM users WHERE email = '${email}'`;

// ❌ VIOLATION - NoSQL Injection
db.users.find({ email: req.body.email });  // If email is {"$ne": null}

// ❌ VIOLATION - Command Injection
exec(`ping ${userInput}`);

// ✅ COMPLIANT - Parameterized query
const query = 'SELECT * FROM users WHERE email = ?';
db.query(query, [email]);

// ✅ COMPLIANT - NoSQL with validation
const email = String(req.body.email);
db.users.find({ email: email });

// ✅ COMPLIANT - Command validation
const { execFile } = require('child_process');
execFile('ping', ['-c', '1', validatedHost]);
```

### A04:2021 - Insecure Design

#### Checklist
```markdown
- [ ] Threat modeling performed
- [ ] Security requirements defined
- [ ] Secure development lifecycle followed
- [ ] Rate limiting implemented
- [ ] Resource limits enforced
- [ ] Circuit breaker patterns for external services
- [ ] Defense in depth strategy
- [ ] Fail securely (fail closed, not open)
```

### A05:2021 - Security Misconfiguration

#### Checklist
```markdown
- [ ] No default credentials
- [ ] No unnecessary features enabled
- [ ] Security headers configured
- [ ] Error messages don't leak information
- [ ] Latest security patches applied
- [ ] No directory listing
- [ ] Proper file permissions
- [ ] Secure admin interfaces
- [ ] No debug mode in production
```

#### Detection Patterns
```javascript
// ❌ VIOLATION - Debug mode enabled
if (process.env.NODE_ENV === 'production') {
  app.use(express.errorHandler());  // Leaks stack traces
}

// ❌ VIOLATION - Detailed error messages
app.use((err, req, res, next) => {
  res.status(500).json({
    error: err.message,
    stack: err.stack,  // Information disclosure
    query: req.query
  });
});

// ✅ COMPLIANT - Generic error messages
app.use((err, req, res, next) => {
  logger.error(err);  // Log details server-side
  res.status(500).json({
    error: 'Internal server error'  // Generic message
  });
});
```

### A06:2021 - Vulnerable and Outdated Components

#### Checklist
```markdown
- [ ] Dependencies regularly updated
- [ ] No known vulnerable dependencies
- [ ] Dependency scanning in CI/CD
- [ ] Unused dependencies removed
- [ ] Dependencies from trusted sources only
- [ ] Software Bill of Materials (SBOM) maintained
- [ ] Security advisories monitored
```

### A07:2021 - Identification and Authentication Failures

#### Checklist
```markdown
- [ ] Strong password requirements
- [ ] Multi-factor authentication available
- [ ] Secure session management
- [ ] No credential stuffing vulnerabilities
- [ ] Account lockout after failed attempts
- [ ] Secure password recovery
- [ ] Session invalidation on logout
- [ ] Session timeout implemented
- [ ] No weak password hashing
```

### A08:2021 - Software and Data Integrity Failures

#### Checklist
```markdown
- [ ] Code signing implemented
- [ ] Integrity checks for updates
- [ ] No insecure deserialization
- [ ] CI/CD pipeline security
- [ ] Dependency integrity verification (SRI)
- [ ] No untrusted data deserialization
```

#### Detection Patterns
```javascript
// ❌ VIOLATION - Insecure deserialization
const userData = JSON.parse(req.body.data);
eval(userData.code);  // Never do this

// ❌ VIOLATION - No integrity check
<script src="https://cdn.example.com/library.js"></script>

// ✅ COMPLIANT - Subresource Integrity
<script
  src="https://cdn.example.com/library.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/ux..."
  crossorigin="anonymous">
</script>
```

### A09:2021 - Security Logging and Monitoring Failures

#### Checklist
```markdown
- [ ] Authentication events logged
- [ ] Authorization failures logged
- [ ] Input validation failures logged
- [ ] Logs protected from tampering
- [ ] Sensitive data not logged
- [ ] Centralized logging
- [ ] Log retention policy
- [ ] Alerting for suspicious activities
- [ ] Regular log review
```

#### Detection Patterns
```javascript
// ❌ VIOLATION - No logging
app.post('/login', async (req, res) => {
  const user = await authenticate(req.body);
  res.json({ token: generateToken(user) });
  // No logging of authentication attempts
});

// ❌ VIOLATION - Logging sensitive data
logger.info('User login', {
  email: user.email,
  password: req.body.password,  // Never log passwords
  ssn: user.ssn
});

// ✅ COMPLIANT - Proper security logging
app.post('/login', async (req, res) => {
  try {
    const user = await authenticate(req.body);
    logger.info('Successful login', {
      userId: user.id,
      i