skill-security-auditor

1# Security Auditor Guide
2 
3## Overview
4 
5This guide covers security auditing workflows for source code, dependencies, and configurations. For detailed vulnerability patterns and detection rules, see references/vulnerability-patterns.md. For secrets detection patterns, see references/secrets-patterns.md.
6 
7## Quick Start
8 
9Run the bundled scan script against a project directory:
10 
11```bash
12python scripts/scan_project.py /path/to/project
13```
14 
15This performs a lightweight scan for common issues: hardcoded secrets, dangerous function calls, and insecure patterns. For deeper analysis, follow the workflows below.
16 
17### Testing the scripts
18 
19```bash
20python scripts/scan_project.py /path/to/some/project --format text
21python scripts/scan_secrets.py /path/to/some/project --format text
22```
23 
24## Audit Workflow
25 
26### 1. Reconnaissance
27 
28Before auditing, understand the project:
29 
30```bash
31# Identify languages, frameworks, and entry points
32find . -type f -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.go" -o -name "*.java" | head -20
33cat package.json pyproject.toml requirements.txt go.mod pom.xml 2>/dev/null
34```
35 
36Key questions:
37- What frameworks are used? (Express, Django, Flask, Spring, etc.)
38- Where are the entry points? (routes, controllers, API handlers)
39- How is authentication handled?
40- What external services are called?
41- Is user input accepted? Where?
42 
43### 2. Secrets Detection
44…