security-audit

What this skill does

# Security Audit

Perform a comprehensive client-side security assessment of a web page. Uses
CDP Security and Audits domains to detect mixed content, insecure cookies, and
CSP violations. Supplements with browser evaluation for SRI checks and meta
CSP, and independent TLS analysis via openssl and curl.

## When to Use

- Pre-launch security review of a web application.
- Investigating mixed content warnings or CSP violation reports.
- Auditing cookie security flags (Secure, HttpOnly, SameSite) for compliance.
- Verifying TLS configuration and certificate validity.
- Checking that CDN scripts have Subresource Integrity (SRI) attributes.
- Validating security headers are properly set (HSTS, X-Frame-Options, etc.).

## Prerequisites

- **Playwright MCP server** connected and responding.
- **Chromium-based browser** for CDP Security and Audits domains.
- **openssl** and **curl** available in the shell for TLS and header analysis.
- Target page must be reachable from the browser instance.

## Workflow

### Phase 1: Enable CDP Security and Audits Domains

```javascript
browser_run_code({
  code: `async (page) => {
    const client = await page.context().newCDPSession(page);

    await client.send('Security.enable');
    await client.send('Audits.enable');
    await client.send('Network.enable');

    const findings = {
      securityState: null,
      mixedContent: [],
      cookieIssues: [],
      cspViolations: [],
      otherIssues: [],
      certificates: []
    };

    // Security state changes
    client.on('Security.visibleSecurityStateChanged', (params) => {
      findings.securityState = {
        securityState: params.visibleSecurityState.securityState,
        certificateSecurityState: params.visibleSecurityState.certificateSecurityState || null,
        safetyTipInfo: params.visibleSecurityState.safetyTipInfo || null
      };
    });

    // Audits domain catches mixed content, cookie issues, CSP, etc.
    client.on('Audits.issueAdded', (params) => {
      const issue = params.issue;
      const code = issue.code;
      const details = issue.details;

      if (details.mixedContentIssueDetails) {
        findings.mixedContent.push({
          resourceType: details.mixedContentIssueDetails.resourceType,
          resolutionStatus: details.mixedContentIssueDetails.resolutionStatus,
          insecureURL: details.mixedContentIssueDetails.insecureURL,
          mainResourceURL: details.mixedContentIssueDetails.mainResourceURL,
          request: details.mixedContentIssueDetails.request
        });
      } else if (details.cookieIssueDetails) {
        findings.cookieIssues.push({
          cookie: details.cookieIssueDetails.cookie,
          cookieWarningReasons: details.cookieIssueDetails.cookieWarningReasons,
          cookieExclusionReasons: details.cookieIssueDetails.cookieExclusionReasons,
          operation: details.cookieIssueDetails.operation
        });
      } else if (details.contentSecurityPolicyIssueDetails) {
        findings.cspViolations.push({
          violatedDirective: details.contentSecurityPolicyIssueDetails.violatedDirective,
          blockedURL: details.contentSecurityPolicyIssueDetails.blockedURL,
          isReportOnly: details.contentSecurityPolicyIssueDetails.isReportOnly,
          contentSecurityPolicyViolationType: details.contentSecurityPolicyIssueDetails.contentSecurityPolicyViolationType,
          sourceCodeLocation: details.contentSecurityPolicyIssueDetails.sourceCodeLocation
        });
      } else {
        findings.otherIssues.push({
          code: code,
          details: JSON.stringify(details).substring(0, 500)
        });
      }
    });

    globalThis.__securityAudit = { client, findings };
    return 'Security audit interceptors installed';
  }`
})
```

### Phase 2: Navigate to Target

```
browser_navigate({ url: "<target_url>" })
```

```
browser_wait_for({ time: 5 })
```

### Phase 3: Analyze Cookies

Extract all cookies with full attribute inspection via CDP.

```javascript
browser_run_code({
  code: `async (page) => {
    const client = globalThis.__securityAudit.client;
    const { cookies } = await client.send('Network.getAllCookies');

    const analyzed = cookies.map(c => {
      const issues = [];
      if (!c.secure) issues.push('Missing Secure flag');
      if (!c.httpOnly && c.name.match(/session|token|auth|csrf/i)) {
        issues.push('Sensitive cookie missing HttpOnly');
      }
      if (c.sameSite === 'None' && !c.secure) {
        issues.push('SameSite=None requires Secure');
      }
      if (!c.sameSite || c.sameSite === 'None') {
        issues.push('Consider SameSite=Lax or Strict');
      }
      if (c.expires === -1) {
        // Session cookie -- acceptable but note it
      } else if (c.expires > 0) {
        const daysUntilExpiry = (c.expires - Date.now() / 1000) / 86400;
        if (daysUntilExpiry > 365) issues.push('Expires in ' + Math.round(daysUntilExpiry) + ' days (excessive)');
      }

      return {
        name: c.name,
        domain: c.domain,
        path: c.path,
        secure: c.secure,
        httpOnly: c.httpOnly,
        sameSite: c.sameSite || 'None (default)',
        expires: c.expires === -1 ? 'Session' : new Date(c.expires * 1000).toISOString(),
        size: c.size,
        priority: c.priority,
        issues
      };
    });

    return {
      total: analyzed.length,
      withIssues: analyzed.filter(c => c.issues.length > 0).length,
      cookies: analyzed
    };
  }`
})
```

### Phase 4: Check SRI and Meta CSP in Page Context

```javascript
browser_evaluate({
  function: `() => {
    // SRI check: external scripts and stylesheets from CDN/third-party origins
    const pageOrigin = window.location.origin;
    const externalResources = [];
    document.querySelectorAll('script[src], link[rel="stylesheet"][href]').forEach(el => {
      const url = el.src || el.href;
      try {
        const resourceOrigin = new URL(url, window.location.href).origin;
        if (resourceOrigin !== pageOrigin) {
          externalResources.push({
            tag: el.tagName,
            url: url.substring(0, 200),
            hasIntegrity: !!el.integrity,
            integrity: el.integrity || null,
            crossorigin: el.crossOrigin || el.getAttribute('crossorigin') || null
          });
        }
      } catch {}
    });

    // Meta CSP
    const metaCSP = [];
    document.querySelectorAll('meta[http-equiv="Content-Security-Policy"]').forEach(el => {
      metaCSP.push(el.content);
    });

    // Check for open redirect patterns in links
    const suspiciousLinks = [];
    document.querySelectorAll('a[href]').forEach(a => {
      const href = a.href;
      if (/[?&](redirect|url|next|return|goto|target)=/i.test(href)) {
        suspiciousLinks.push({
          text: (a.textContent || '').substring(0, 50),
          href: href.substring(0, 200)
        });
      }
    });

    // Check for password inputs without autocomplete=off
    const passwordInputs = [];
    document.querySelectorAll('input[type="password"]').forEach(input => {
      passwordInputs.push({
        name: input.name || input.id || '(unnamed)',
        autocomplete: input.autocomplete || 'not set',
        form: input.form ? (input.form.action || '').substring(0, 100) : null
      });
    });

    return {
      sri: {
        totalExternal: externalResources.length,
        withSRI: externalResources.filter(r => r.hasIntegrity).length,
        resources: externalResources
      },
      metaCSP,
      suspiciousLinks,
      passwordInputs
    };
  }`
})
```

### Phase 5: TLS Certificate Analysis via OpenSSL

Replace `<hostname>` with the actual target hostname.

```bash
echo | openssl s_client -connect <hostname>:443 -servername <hostname> 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName -checkend 2592000
```

Check supported TLS versions and cipher suites:

```bash
echo | openssl s_client -connect <hostname>:443 -servername <hostname> -tls1_2 2>&1 | gr