470 lines
13 KiB
Markdown
470 lines
13 KiB
Markdown
## Operation: Full Security Audit
|
|
|
|
Execute comprehensive security audit combining all security scans: secrets, URLs, files, and permissions.
|
|
|
|
### Parameters from $ARGUMENTS
|
|
|
|
- **path**: Target directory to audit (required)
|
|
- **severity**: Minimum severity to report (critical|high|medium|low, default: medium)
|
|
- **strict**: Enable strict mode for all checks (true|false, default: false)
|
|
- **format**: Output format (text|json|markdown, default: text)
|
|
|
|
### Full Audit Workflow
|
|
|
|
1. **Initialize audit**
|
|
```
|
|
Validate path exists
|
|
Parse severity threshold
|
|
Set strict mode for all sub-scans
|
|
Initialize results aggregator
|
|
```
|
|
|
|
2. **Execute all security scans**
|
|
```
|
|
PARALLEL EXECUTION (where possible):
|
|
|
|
┌─ Scan 1: Secret Detection
|
|
│ Read scan-secrets.md
|
|
│ Execute with path, recursive:true, severity
|
|
│ Capture results
|
|
│
|
|
├─ Scan 2: URL Safety Check
|
|
│ Read check-urls.md
|
|
│ Execute with path, https-only, check-code-patterns
|
|
│ Capture results
|
|
│
|
|
├─ Scan 3: Dangerous Files
|
|
│ Read scan-files.md
|
|
│ Execute with path, include-hidden, check-gitignore
|
|
│ Capture results
|
|
│
|
|
└─ Scan 4: Permission Audit
|
|
Read check-permissions.md
|
|
Execute with path, strict, check-executables
|
|
Capture results
|
|
```
|
|
|
|
3. **Aggregate results**
|
|
```
|
|
Combine all findings
|
|
Deduplicate issues
|
|
Sort by severity:
|
|
1. CRITICAL issues (block publication)
|
|
2. HIGH issues (fix before publication)
|
|
3. MEDIUM issues (recommended fixes)
|
|
4. LOW issues (nice to have)
|
|
|
|
Calculate overall security score:
|
|
Base score: 100
|
|
- CRITICAL: -25 points each
|
|
- HIGH: -10 points each
|
|
- MEDIUM: -5 points each
|
|
- LOW: -2 points each
|
|
Score = max(0, base - deductions)
|
|
```
|
|
|
|
4. **Generate comprehensive report**
|
|
```
|
|
FULL SECURITY AUDIT REPORT
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
Target: <path>
|
|
Scan Date: <timestamp>
|
|
Severity Threshold: <severity>
|
|
|
|
OVERALL SECURITY SCORE: <0-100>/100
|
|
Rating: <Excellent|Good|Fair|Poor|Critical>
|
|
Publication Ready: <Yes|No|With Fixes>
|
|
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
EXECUTIVE SUMMARY
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
Security Posture: <assessment>
|
|
Critical Issues: <count> (IMMEDIATE ACTION REQUIRED)
|
|
High Priority: <count> (FIX BEFORE PUBLICATION)
|
|
Medium Priority: <count> (RECOMMENDED)
|
|
Low Priority: <count> (OPTIONAL)
|
|
|
|
Action Required: <Yes|No>
|
|
Estimated Fix Time: <time_estimate>
|
|
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
SCAN RESULTS BY LAYER
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
[1] SECRET DETECTION
|
|
Status: <PASS|FAIL>
|
|
Secrets Found: <count>
|
|
Files Scanned: <count>
|
|
<Details...>
|
|
|
|
[2] URL SAFETY
|
|
Status: <PASS|FAIL>
|
|
Unsafe URLs: <count>
|
|
URLs Checked: <count>
|
|
<Details...>
|
|
|
|
[3] DANGEROUS FILES
|
|
Status: <PASS|FAIL>
|
|
Dangerous Files: <count>
|
|
Files Scanned: <count>
|
|
<Details...>
|
|
|
|
[4] FILE PERMISSIONS
|
|
Status: <PASS|FAIL>
|
|
Permission Issues: <count>
|
|
Files Checked: <count>
|
|
<Details...>
|
|
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
CRITICAL ISSUES (IMMEDIATE ACTION)
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
❌ Issue 1: <description>
|
|
File: <path>:<line>
|
|
Severity: CRITICAL
|
|
Risk: <risk_assessment>
|
|
Remediation: <specific_steps>
|
|
|
|
❌ Issue 2: ...
|
|
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
HIGH PRIORITY ISSUES
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
⚠️ Issue 1: ...
|
|
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
REMEDIATION PLAN
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
Phase 1: Critical Issues (Immediate)
|
|
□ Remove exposed secrets from .env
|
|
□ Rotate compromised API keys
|
|
□ Fix world-writable permissions (777)
|
|
□ Remove dangerous files from repository
|
|
|
|
Phase 2: High Priority (Before Publication)
|
|
□ Update all HTTP URLs to HTTPS
|
|
□ Add dangerous files to .gitignore
|
|
□ Fix executables without shebangs
|
|
□ Remove remote code execution patterns
|
|
|
|
Phase 3: Recommended Improvements
|
|
□ Restrict config file permissions to 600
|
|
□ Review and expand shortened URLs
|
|
□ Add security documentation
|
|
|
|
Phase 4: Optional Enhancements
|
|
□ Implement pre-commit hooks
|
|
□ Add automated security scanning to CI/CD
|
|
□ Document security best practices
|
|
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
SECURITY RECOMMENDATIONS
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
🔒 Secrets Management
|
|
- Use environment variables for all secrets
|
|
- Implement secret rotation policy
|
|
- Consider using secret management tools
|
|
(AWS Secrets Manager, HashiCorp Vault)
|
|
|
|
🌐 URL Security
|
|
- Enforce HTTPS for all external URLs
|
|
- Verify checksums for downloaded scripts
|
|
- Never pipe remote content to shell
|
|
|
|
📁 File Security
|
|
- Review .gitignore completeness
|
|
- Remove sensitive files from git history
|
|
- Implement file scanning in CI/CD
|
|
|
|
🔐 Permission Security
|
|
- Use least privilege principle
|
|
- Document required permissions
|
|
- Regular permission audits
|
|
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
PUBLICATION READINESS
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
<if score >= 90>
|
|
✅ READY FOR PUBLICATION
|
|
Security score is excellent. No critical issues found.
|
|
All security checks passed. Safe to publish.
|
|
|
|
<if 70 <= score < 90>
|
|
⚠️ READY WITH MINOR FIXES
|
|
Security score is good but has some issues.
|
|
Fix high priority issues before publication.
|
|
Estimated fix time: <time>
|
|
|
|
<if score < 70>
|
|
❌ NOT READY FOR PUBLICATION
|
|
Critical security issues must be resolved.
|
|
Publication blocked until critical issues fixed.
|
|
Do not publish in current state.
|
|
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
NEXT STEPS
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
1. Address all CRITICAL issues immediately
|
|
2. Fix HIGH priority issues before publication
|
|
3. Review and implement recommended improvements
|
|
4. Re-run full security audit to verify fixes
|
|
5. Document security practices for maintainers
|
|
```
|
|
|
|
### Security Score Calculation
|
|
|
|
```
|
|
Base Score: 100 points
|
|
|
|
Deductions:
|
|
- CRITICAL issues: -25 points each
|
|
- HIGH issues: -10 points each
|
|
- MEDIUM issues: -5 points each
|
|
- LOW issues: -2 points each
|
|
|
|
Final Score: max(0, Base - Deductions)
|
|
|
|
Rating Scale:
|
|
- 90-100: Excellent ⭐⭐⭐⭐⭐ (Publication ready)
|
|
- 70-89: Good ⭐⭐⭐⭐ (Ready with minor fixes)
|
|
- 50-69: Fair ⭐⭐⭐ (Needs work)
|
|
- 30-49: Poor ⭐⭐ (Not ready)
|
|
- 0-29: Critical ⭐ (Major security issues)
|
|
```
|
|
|
|
### Examples
|
|
|
|
```bash
|
|
# Full security audit with default settings
|
|
/security-scan full-security-audit path:.
|
|
|
|
# Strict mode - enforce all strict rules
|
|
/security-scan full-security-audit path:. strict:true
|
|
|
|
# Only report critical and high issues
|
|
/security-scan full-security-audit path:. severity:high
|
|
|
|
# JSON output for CI/CD integration
|
|
/security-scan full-security-audit path:. format:json
|
|
|
|
# Markdown report for documentation
|
|
/security-scan full-security-audit path:. format:markdown
|
|
```
|
|
|
|
### Error Handling
|
|
|
|
**Path not found**:
|
|
```
|
|
ERROR: Path does not exist: <path>
|
|
Remediation: Verify path and try again
|
|
```
|
|
|
|
**Scan failures**:
|
|
```
|
|
WARNING: One or more security scans failed
|
|
Partial results available:
|
|
- Secrets: ✓ Completed
|
|
- URLs: ✓ Completed
|
|
- Files: ✗ Failed
|
|
- Permissions: ✓ Completed
|
|
|
|
Recommendation: Review failures and re-run
|
|
```
|
|
|
|
**All scans passed**:
|
|
```
|
|
SUCCESS: Full Security Audit Passed
|
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
Security Score: 100/100 ⭐⭐⭐⭐⭐
|
|
Rating: Excellent
|
|
|
|
All security checks passed with no issues.
|
|
Your plugin/marketplace is secure and ready for publication.
|
|
|
|
Summary:
|
|
✓ No secrets detected
|
|
✓ All URLs safe
|
|
✓ No dangerous files
|
|
✓ All permissions correct
|
|
|
|
Excellent security posture! 🎉
|
|
```
|
|
|
|
### Integration with CI/CD
|
|
|
|
**GitHub Actions Example**:
|
|
```yaml
|
|
name: Security Audit
|
|
|
|
on: [push, pull_request]
|
|
|
|
jobs:
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Run Security Audit
|
|
run: |
|
|
/security-scan full-security-audit path:. format:json > security-report.json
|
|
|
|
- name: Check Security Score
|
|
run: |
|
|
score=$(jq '.security_score' security-report.json)
|
|
if [ $score -lt 70 ]; then
|
|
echo "Security score too low: $score"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Upload Report
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: security-report
|
|
path: security-report.json
|
|
```
|
|
|
|
**GitLab CI Example**:
|
|
```yaml
|
|
security_audit:
|
|
stage: test
|
|
script:
|
|
- /security-scan full-security-audit path:. format:json
|
|
only:
|
|
- main
|
|
- merge_requests
|
|
artifacts:
|
|
reports:
|
|
security: security-report.json
|
|
```
|
|
|
|
### Report Formats
|
|
|
|
**Text Format** (default):
|
|
- Human-readable console output
|
|
- Color-coded severity levels
|
|
- Section dividers for clarity
|
|
- Suitable for terminal viewing
|
|
|
|
**JSON Format**:
|
|
```json
|
|
{
|
|
"scan_type": "full-audit",
|
|
"timestamp": "<ISO8601>",
|
|
"path": "<path>",
|
|
"security_score": <0-100>,
|
|
"rating": "<rating>",
|
|
"publication_ready": <boolean>,
|
|
"scans": {
|
|
"secrets": { "status": "pass", "issues": [] },
|
|
"urls": { "status": "fail", "issues": [...] },
|
|
"files": { "status": "pass", "issues": [] },
|
|
"permissions": { "status": "pass", "issues": [] }
|
|
},
|
|
"severity_breakdown": {
|
|
"critical": <count>,
|
|
"high": <count>,
|
|
"medium": <count>,
|
|
"low": <count>
|
|
},
|
|
"all_findings": [...],
|
|
"remediation_plan": [...],
|
|
"recommendations": [...]
|
|
}
|
|
```
|
|
|
|
**Markdown Format**:
|
|
- GitHub/GitLab compatible
|
|
- Can be added to PR comments
|
|
- Suitable for documentation
|
|
- Includes tables and checkboxes
|
|
|
|
### Time Estimates
|
|
|
|
**By Issue Count**:
|
|
- 0 issues: No time needed ✅
|
|
- 1-3 CRITICAL: 2-4 hours
|
|
- 4-10 HIGH: 1-2 hours
|
|
- 11-20 MEDIUM: 30-60 minutes
|
|
- 20+ LOW: 15-30 minutes
|
|
|
|
**By Issue Type**:
|
|
- Secret rotation: 30-60 minutes each
|
|
- URL updates: 5-10 minutes each
|
|
- File removal: 15-30 minutes (including .gitignore)
|
|
- Permission fixes: 5 minutes total (batch operation)
|
|
|
|
### Remediation Verification
|
|
|
|
After fixing issues, re-run audit:
|
|
|
|
```bash
|
|
# Fix issues
|
|
chmod 755 scripts/*.sh
|
|
git rm .env
|
|
echo ".env" >> .gitignore
|
|
|
|
# Verify fixes
|
|
/security-scan full-security-audit path:.
|
|
|
|
# Should see improved score
|
|
```
|
|
|
|
### Best Practices
|
|
|
|
**Regular Audits**:
|
|
- Run before each release
|
|
- Include in CI/CD pipeline
|
|
- Weekly scans for active development
|
|
- After adding dependencies
|
|
|
|
**Fix Priority**:
|
|
1. CRITICAL: Drop everything and fix
|
|
2. HIGH: Fix within 24 hours
|
|
3. MEDIUM: Fix within 1 week
|
|
4. LOW: Address when convenient
|
|
|
|
**Team Communication**:
|
|
- Share audit results with team
|
|
- Document security requirements
|
|
- Train on secure development
|
|
- Review security in code reviews
|
|
|
|
### Output Format
|
|
|
|
```json
|
|
{
|
|
"scan_type": "full-audit",
|
|
"timestamp": "<ISO8601>",
|
|
"path": "<path>",
|
|
"security_score": <0-100>,
|
|
"rating": "<Excellent|Good|Fair|Poor|Critical>",
|
|
"publication_ready": <boolean>,
|
|
"estimated_fix_time": "<time_string>",
|
|
"severity_breakdown": {
|
|
"critical": <count>,
|
|
"high": <count>,
|
|
"medium": <count>,
|
|
"low": <count>
|
|
},
|
|
"scan_results": {
|
|
"secrets": { "status": "pass|fail", "findings": [...] },
|
|
"urls": { "status": "pass|fail", "findings": [...] },
|
|
"files": { "status": "pass|fail", "findings": [...] },
|
|
"permissions": { "status": "pass|fail", "findings": [...] }
|
|
},
|
|
"all_findings": [...],
|
|
"remediation_plan": [...],
|
|
"recommendations": [...],
|
|
"action_required": <boolean>
|
|
}
|
|
```
|
|
|
|
**Request**: $ARGUMENTS
|