Run a complete security audit using the OWASP Top 10 checklist with severity scoring.

Check this Node.js codebase for injection vulnerabilities and authentication issues.

# String interpolation in queries
grep -rn "\`SELECT.*\${" src/
grep -rn "\"SELECT.*\" \+" src/
grep -rn "query.*\`.*\${" src/
grep -rn "execute.*f\"" src/  # Python f-strings

# Raw queries without parameterization
grep -rn "\.raw\(" src/
grep -rn "\.rawQuery\(" src/
grep -rn "createQuery.*\+" src/  # Java JPA

Location: {file}:{line}
Pattern: Unparameterized SQL with user input
Measurement: {count} injection vectors
Impact: Full database compromise, data exfiltration

# Command injection
grep -rn "exec\(" src/
grep -rn "eval\(" src/
grep -rn "spawn.*shell.*true" src/
grep -rn "subprocess.*shell=True" src/
grep -rn "os\.system\(" src/

# Unsafe deserialization
grep -rn "pickle\.loads\(" src/
grep -rn "yaml\.load\(" src/ | grep -v "safe_load"
grep -rn "ObjectInputStream" src/
grep -rn "unserialize\(" src/

Location: {file}:{line}
Pattern: {exec|eval|deserialization} with user-controlled input
Measurement: {count} RCE vectors
Impact: Complete server compromise, lateral movement

# API keys and tokens
grep -rn "AKIA[0-9A-Z]{16}" src/
grep -rn "sk_live_" src/
grep -rn "gh[pousr]_[A-Za-z0-9_]" src/
grep -rn "xox[baprs]-" src/

# Generic patterns
grep -rn "password\s*=\s*['\"]" src/
grep -rn "api_key\s*=\s*['\"]" src/
grep -rn "secret\s*=\s*['\"]" src/
grep -rn "token\s*=\s*['\"][^'\"]*['\"]" src/

# Private keys
grep -rn "BEGIN.*PRIVATE KEY" src/
grep -rn "BEGIN RSA PRIVATE" src/

Location: {file}:{line}
Pattern: {AWS key|Stripe key|generic secret} hardcoded
Measurement: {count} secrets exposed
Impact: Credential theft, financial fraud, account takeover

# Missing auth middleware
grep -rn "app\.\(get\|post\|put\|delete\)" src/ | grep -v "auth\|protect\|require"

# JWT issues
grep -rn "algorithm.*none" src/
grep -rn "verify.*false" src/
grep -rn "ignoreExpiration.*true" src/

# Session issues
grep -rn "session\.secret.*=.*['\"]" src/
grep -rn "secure.*false" src/ | grep -i cookie

Location: {file}:{line}
Pattern: {missing auth check|weak JWT|insecure session}
Measurement: {count} unprotected endpoints
Impact: Unauthorized access, privilege escalation

# React dangerouslySetInnerHTML
grep -rn "dangerouslySetInnerHTML" src/

# Template injection
grep -rn "<%- " src/  # EJS unescaped
grep -rn "\|safe" src/  # Django/Jinja unescaped
grep -rn "v-html" src/  # Vue
grep -rn "{!! " src/  # Laravel Blade

# DOM manipulation
grep -rn "\.innerHTML\s*=" src/
grep -rn "document\.write\(" src/

Location: {file}:{line}
Pattern: {dangerouslySetInnerHTML|innerHTML|unescaped template}
Measurement: {count} XSS vectors
Impact: Session hijacking, credential theft, defacement

# Direct ID usage without ownership check
grep -rn "params\.id\|req\.params\.id" src/
grep -rn "findById.*req\.params" src/
grep -rn "findOne.*id.*=.*req" src/

# Check if ownership validation exists nearby

# URL from user input
grep -rn "fetch\(.*req\." src/
grep -rn "axios\.\(get\|post\).*req\." src/
grep -rn "requests\.get\(.*request\." src/
grep -rn "http\.get\(.*params" src/

# Redirects
grep -rn "redirect\(.*req\." src/

Location: {file}:{line}
Pattern: HTTP request with user-controlled URL
Measurement: {count} SSRF vectors
Impact: Internal network scanning, cloud metadata access

# Check for rate limiter middleware
grep -rn "rateLimit\|rate-limit\|RateLimiter" src/

# Sensitive endpoints without rate limiting
grep -rn "login\|register\|password\|forgot\|reset" src/routes/

# Direct body/query usage without validation
grep -rn "req\.body\." src/ | head -20
grep -rn "req\.query\." src/ | head -20
grep -rn "request\.json\(\)" src/

# Check for validation libraries
grep -rn "zod\|yup\|joi\|validator\|pydantic" package.json src/

# Weak hash algorithms
grep -rn "md5\|MD5" src/
grep -rn "sha1\|SHA1" src/ | grep -v "sha1.*integrity"

# Weak encryption
grep -rn "DES\|3DES\|RC4\|ECB" src/

# Insecure random
grep -rn "Math\.random\(\)" src/
grep -rn "random\.random\(\)" src/

# Check for helmet or manual headers
grep -rn "helmet\|setHeader.*Content-Security" src/
grep -rn "X-Frame-Options\|X-Content-Type" src/

# Dangerous CORS patterns
grep -rn "origin.*\*\|origin.*true" src/
grep -rn "Access-Control-Allow-Origin.*\*" src/
grep -rn "credentials.*true" src/ | grep -i cors

# Check for origin reflection
grep -rn "origin.*req\.headers\.origin" src/

# Stack traces exposed
grep -rn "error\.stack\|err\.stack" src/
grep -rn "res\.send.*error\|res\.json.*error" src/

# Debug mode in production
grep -rn "DEBUG.*true\|debug.*=.*true" src/

# NPM security audit
npm audit --json 2>/dev/null | jq '.metadata.vulnerabilities'

# Check for outdated
npm outdated 2>/dev/null

# Python
pip-audit 2>/dev/null
safety check 2>/dev/null

## Security Audit Summary

| Severity | Count | Total Deduction |
|----------|-------|-----------------|
| Critical | {n} | {n * 4.0} |
| High | {n} | {n * 2.25} |
| Medium | {n} | {n * 0.75} |
| Low | {n} | {n * 0.125} |
| **Total** | **{sum}** | **{sum} points** |

### Critical Findings (P0)

#### Finding 1: {Title}
| Field | Value |
|-------|-------|
| Location | `{file}:{line}` |
| Vulnerability | {type} |
| OWASP | A0{n}:{name} |
| CVSS | {score} |
| Deduction | {points} |

**Evidence:**
```{lang}
{code snippet}

## Integration with Brutal Reviewer

This skill provides the Security category scoring for the brutal-reviewer agent:

- **Weight:** 12% of total score
- **Maximum Deduction:** 9.0 points (capped)
- **Grade Thresholds:**
  - A: 0 critical, 0 high
  - B: 0 critical, 1-2 high
  - C: 0 critical, 3+ high OR 1 critical (fixed quickly)
  - D: 1-2 critical
  - F: 3+ critical OR any actively exploitable