security-auditlisted

# Security Audit Skill Comprehensive security review including vulnerabilities, code patterns, and secrets. ## When to Use This skill auto-activates when: - User asks about security vulnerabilities - User wants a security audit or review - User mentions "security", "vulnerabilities", or "secrets" - User asks about OWASP, CVE, or security best practices ## Workflow 1. **Check NuGet vulnerabilities** - Call `nuget_check_vulnerabilities(project_or_sln, include_transitive=true)` - Categorize by severity (Critical, High, Medium, Low) 2. **Scan for secrets** (using Grep) Search for patterns: ``` - API keys: /api[_-]?key/i - Connection strings: /connectionstring.*password/i - Passwords: /password\s*=\s*["'][^"']+["']/i - Tokens: /bearer\s+[a-zA-Z0-9-_.]+/i - AWS keys: /AKIA[0-9A-Z]{16}/ - Private keys: /-----BEGIN.*PRIVATE KEY-----/ ``` 3. **Check for vulnerable code patterns** ### SQL Injection ```csharp // VULNERABLE $"SELECT * FROM Users WHERE Id = {id}" string.Format("...{0}...", userInput) // SAFE command.Parameters.AddWithValue("@id", id) ``` ### XSS ```csharp // VULNERABLE @Html.Raw(userInput) // SAFE @Html.Encode(userInput) ``` ### Path Traversal ```csharp // VULNERABLE File.ReadAllText(userProvidedPath) // SAFE Path.GetFullPath() + validation ``` ### Insecure Deserialization ```csharp // VULNERABLE BinaryFormatter, NetDataContractSerializer JsonCon