Security Lint & Threat Detector

When to use this skill

• User asks to scan code for security issues
• User mentions OWASP vulnerabilities
• User wants to find leaked credentials or secrets
• User asks about XSS, SQL injection, or CSRF risks
• User wants to audit code before deployment

Workflow

• [ ] Identify files to scan (changed or full codebase)
• [ ] Run automated security scanners
• [ ] Perform pattern-based detection
• [ ] Categorize findings by severity
• [ ] Provide remediation suggestions
• [ ] Generate security report

Instructions

Step 1: Identify Scan Scope

For changed files:

git diff --cached --name-only --diff-filter=ACMR | grep -E '\.(js|jsx|ts|tsx|py|rb|php|java|go)$'

For full codebase:

find src -type f \( -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.jsx" \)

Step 2: Run Security Scanners

JavaScript/TypeScript — npm audit:

npm audit --json

JavaScript/TypeScript — Snyk (if available):

npx snyk test --json

ESLint security plugin:

npx eslint --plugin security --rule 'security/*: error' <files>

Semgrep (multi-language):

npx @semgrep/semgrep --config=auto --json .

Gitleaks (secrets detection):

gitleaks detect --source . --report-format json

Step 3: Pattern-Based Detection

Scan for these high-risk patterns:

#### Credential Leakage

grep -rn --include="*.{ts,js,tsx,jsx,json,env}" -E "AKIA[0-9A-Z]{16}" .
grep -rn --include="*.{ts,js,tsx,jsx}" -E "(api[_-]?key|apikey)\s*[:=]\s*['\"][^'\"]{16,}['\"]" .

#### Unsafe Code Patterns

grep -rn --include="*.{ts,js,tsx,jsx}" -E "\beval\s*\(" .
grep -rn --include="*.tsx" "dangerouslySetInnerHTML" .
grep -rn --include="*.vue" "v-html" .
grep -rn --include="*.{ts,js}" -E "\.exec\s*\(.*\$\{" .

#### OWASP Top 10 Checks

Step 4: Categorize Findings

Severity levels:

Step 5: Generate Report

Format findings clearly:

## Security Scan Report

### Critical (2)

#### 1. Hardcoded API Key

- **File**: src/api/client.ts:42
- **Pattern**: `apiKey = "sk_live_..."`
- **Risk**: Credential exposure in source control
- **Fix**: Move to environment variable

// Before const apiKey = "sk_live_abc123...";

// After const apiKey = process.env.API_KEY;

#### 2. SQL Injection Risk

• File: src/db/users.ts:23
• Pattern: String concatenation in query
• Risk: SQL injection allows data theft
• Fix: Use parameterized queries

// Before
db.query(`SELECT * FROM users WHERE id = ${userId}`);

// After
db.query("SELECT * FROM users WHERE id = $1", [userId]);

High (1)

#### 1. XSS via dangerouslySetInnerHTML

• File: src/components/Article.tsx:15
• Risk: User content rendered as HTML
• Fix: Sanitize with DOMPurify

import DOMPurify from "dompurify";
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(content) }} />;

Summary

## Common Remediation Patterns

**Environment variables for secrets:**

// Use dotenv or platform env const secret = process.env.SECRET_KEY; if (!secret) throw new Error('SECRET_KEY required');

**Parameterized queries:**

// Prisma (safe by default) await prisma.user.findUnique({ where: { id: userId } });

// Raw SQL with parameters await db.query("SELECT * FROM users WHERE id = $1", [userId]);

**XSS prevention:**

// React - avoid dangerouslySetInnerHTML // If needed, sanitize first import DOMPurify from "dompurify"; const clean = DOMPurify.sanitize(userContent);

**CSRF protection:**

// Use CSRF tokens in forms <input type="hidden" name="_csrf" value={csrfToken} />

// Validate on server if (req.body._csrf !== req.session.csrfToken) { throw new Error('CSRF validation failed'); }

**Secure headers:**

// Next.js next.config.js const securityHeaders = [ { key: "X-Content-Type-Options", value: "nosniff" }, { key: "X-Frame-Options", value: "DENY" }, { key: "X-XSS-Protection", value: "1; mode=block" }, { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains", }, ];

## Validation

Before completing:

- [ ] All critical issues addressed
- [ ] High severity issues have remediation plan
- [ ] No secrets in committed code
- [ ] Dependencies updated for known CVEs
- [ ] Security headers configured

## Error Handling

- **Scanner not installed**: Run `npm install -g <tool>` or use npx.
- **Too many results**: Filter by severity or scope to changed files.
- **False positives**: Review context before reporting; exclude test fixtures.
- **Unsure about severity**: Default to higher severity; security errs on caution.

## Resources

- [OWASP Top 10](https://owasp.org/Top10/)
- [OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/)
- [Semgrep Rules](https://semgrep.dev/explore)
- [Snyk Vulnerability DB](https://snyk.io/vuln/)