128 lines
3.9 KiB
Markdown
128 lines
3.9 KiB
Markdown
---
|
|
model: claude-sonnet-4-0
|
|
allowed-tools: Task, Bash, Read, Write
|
|
argument-hint: <concern> [focus]
|
|
description: Application security with OWASP best practices and threat modeling
|
|
---
|
|
|
|
# Security Command
|
|
|
|
Application security with OWASP best practices and threat modeling
|
|
|
|
## Purpose
|
|
|
|
Comprehensive security review and hardening for applications, APIs, infrastructure, and automation scripts. Identifies vulnerabilities, recommends mitigations, and ensures security best practices are followed.
|
|
|
|
## SECURITY FOCUS AREAS
|
|
|
|
This command helps you identify and fix security issues across:
|
|
|
|
### Input Validation & Injection Prevention
|
|
- SQL injection vulnerabilities
|
|
- Command injection risks
|
|
- LDAP/XPath/XML injection
|
|
- Path traversal attacks
|
|
- Input sanitization gaps
|
|
|
|
### Authentication & Authorization
|
|
- Broken authentication flows
|
|
- Session management issues
|
|
- Weak credential storage
|
|
- Authorization bypass vulnerabilities
|
|
- JWT/token handling problems
|
|
|
|
### Secrets Management
|
|
- Hardcoded credentials detection
|
|
- API keys in code or configs
|
|
- Unencrypted sensitive data
|
|
- Secrets in logs or error messages
|
|
- Insecure secret transmission
|
|
|
|
### OWASP Top 10 Coverage
|
|
1. Broken Access Control
|
|
2. Cryptographic Failures
|
|
3. Injection Flaws
|
|
4. Insecure Design
|
|
5. Security Misconfiguration
|
|
6. Vulnerable Components
|
|
7. Authentication Failures
|
|
8. Software/Data Integrity Failures
|
|
9. Security Logging Failures
|
|
10. Server-Side Request Forgery
|
|
|
|
### Bash Script Security
|
|
- Command injection vulnerabilities
|
|
- Unquoted variable usage
|
|
- Hardcoded secrets detection
|
|
- Insufficient input validation
|
|
- Dangerous command patterns
|
|
- Permission misconfigurations
|
|
|
|
## Arguments
|
|
|
|
**$1 (Required)**: Security concern or component to review
|
|
- Authentication flow, API endpoint, shell script, configuration, etc.
|
|
|
|
**$2 (Optional)**: Specific focus area
|
|
- `owasp`: OWASP Top 10 systematic review
|
|
- `injection`: Injection vulnerability focus
|
|
- `auth`: Authentication/authorization review
|
|
- `secrets`: Secrets management audit
|
|
- `bash`: Shell script security review
|
|
- `api`: API security assessment
|
|
|
|
## Examples
|
|
|
|
### OWASP Security Review
|
|
```bash
|
|
/security "Review authentication flow" owasp
|
|
```
|
|
Systematic OWASP Top 10 review of authentication implementation
|
|
|
|
### Injection Vulnerability Audit
|
|
```bash
|
|
/security "Audit input validation" injection
|
|
```
|
|
Deep dive on SQL, command, and other injection vulnerabilities
|
|
|
|
### Bash Script Security Review
|
|
```bash
|
|
/security "Review deployment script" bash
|
|
```
|
|
Comprehensive shell script security analysis including command injection, secret detection, and permission review
|
|
|
|
### API Security Assessment
|
|
```bash
|
|
/security "Analyze REST API endpoints" api
|
|
```
|
|
API-specific security review covering authentication, rate limiting, input validation, and OWASP API Security Top 10
|
|
|
|
### Secrets Management Audit
|
|
```bash
|
|
/security "Audit application for secrets" secrets
|
|
```
|
|
Scan for hardcoded credentials, API keys, tokens, and recommend secure secret management
|
|
|
|
## Security Review Protocol
|
|
|
|
The security-guardian agent will:
|
|
|
|
1. **Threat Model**: Identify attack vectors and security boundaries
|
|
2. **Code Review**: Analyze for common vulnerability patterns
|
|
3. **Configuration Review**: Check security settings and misconfigurations
|
|
4. **Secrets Scan**: Detect hardcoded credentials and insecure storage
|
|
5. **Permission Analysis**: Verify least privilege and access control
|
|
6. **Recommendations**: Provide specific, actionable remediation steps
|
|
7. **Priority Assessment**: Categorize findings by severity (Critical/High/Medium/Low)
|
|
|
|
## What You Get
|
|
|
|
- **Vulnerability Report**: Detailed findings with severity levels
|
|
- **Exploit Scenarios**: How vulnerabilities could be exploited
|
|
- **Remediation Steps**: Specific code fixes and configuration changes
|
|
- **Security Patterns**: Recommended secure alternatives
|
|
- **Testing Guidance**: How to validate fixes
|
|
- **Compliance Mapping**: OWASP, CWE, and compliance framework mapping
|
|
|
|
Invoke the security-guardian agent with: $ARGUMENTS
|