Security Lint & Threat Detector

When to use this skill

User asks to scan code for security issues
User mentions OWASP vulnerabilities
User wants to find leaked credentials or secrets
User asks about XSS, SQL injection, or CSRF risks
User wants to audit code before deployment

Workflow

[ ] Identify files to scan (changed or full codebase)
[ ] Run automated security scanners
[ ] Perform pattern-based detection
[ ] Categorize findings by severity
[ ] Provide remediation suggestions
[ ] Generate security report

Instructions

Step 1: Identify Scan Scope

For changed files:

git diff --cached --name-only --diff-filter=ACMR | grep -E '\.(js|jsx|ts|tsx|py|rb|php|java|go)$'

For full codebase:

find src -type f \( -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.jsx" \)

Step 2: Run Security Scanners

JavaScript/TypeScript — npm audit:

npm audit --json

JavaScript/TypeScript — Snyk (if available):

npx snyk test --json

ESLint security plugin:

npx eslint --plugin security --rule 'security/*: error' <files>

Semgrep (multi-language):

npx @semgrep/semgrep --config=auto --json .

Gitleaks (secrets detection):

gitleaks detect --source . --report-format json

Step 3: Pattern-Based Detection

Scan for these high-risk patterns:

Credential Leakage

| Pattern | Risk | Regex | | ------------------ | -------- | --------------------------------------------------------------------- | | API keys | Critical | ['"]?(api[_-]?key\|apikey)['"]?\s*[:=]\s*['"][a-zA-Z0-9]{16,}['"] | | AWS keys | Critical | AKIA[0-9A-Z]{16} | | Private keys | Critical | -----BEGIN (RSA\|DSA\|EC\|OPENSSH) PRIVATE KEY----- | | Passwords | High | ['"]?(password\|passwd\|pwd)['"]?\s*[:=]\s*['"][^'"]{4,}['"] | | Tokens | High | ['"]?(token\|secret\|auth)['"]?\s*[:=]\s*['"][a-zA-Z0-9_-]{20,}['"] | | Connection strings | High | (mongodb\|postgres\|mysql):\/\/[^:]+:[^@]+@ |

grep -rn --include="*.{ts,js,tsx,jsx,json,env}" -E "AKIA[0-9A-Z]{16}" .
grep -rn --include="*.{ts,js,tsx,jsx}" -E "(api[_-]?key|apikey)\s*[:=]\s*['\"][^'\"]{16,}['\"]" .

Unsafe Code Patterns

| Pattern | Risk | Detection | | ------------------------- | -------- | -------------------------- | | eval() | Critical | Direct code execution | | dangerouslySetInnerHTML | High | XSS vulnerability in React | | v-html | High | XSS vulnerability in Vue | | innerHTML assignment | High | DOM-based XSS | | document.write | High | DOM manipulation risk | | new Function() | High | Dynamic code execution | | child_process.exec | High | Command injection risk | | sql + string concat | Critical | SQL injection | | http:// URLs | Medium | Insecure transport |

grep -rn --include="*.{ts,js,tsx,jsx}" -E "\beval\s*\(" .
grep -rn --include="*.tsx" "dangerouslySetInnerHTML" .
grep -rn --include="*.vue" "v-html" .
grep -rn --include="*.{ts,js}" -E "\.exec\s*\(.*\$\{" .

OWASP Top 10 Checks

| OWASP | Vulnerability | What to look for | | ----- | ------------------------- | ------------------------------------------- | | A01 | Broken Access Control | Missing auth checks, direct object refs | | A02 | Cryptographic Failures | Weak algorithms (MD5, SHA1), hardcoded keys | | A03 | Injection | SQL/NoSQL/Command injection patterns | | A04 | Insecure Design | Missing rate limiting, no input validation | | A05 | Security Misconfiguration | CORS *, debug modes, default creds | | A06 | Vulnerable Components | Outdated dependencies | | A07 | Auth Failures | Weak password rules, session issues | | A08 | Data Integrity | Unsafe deserialization, unverified updates | | A09 | Logging Failures | Sensitive data in logs, missing audit | | A10 | SSRF | Unvalidated URL fetches |

Step 4: Categorize Findings

Severity levels:

| Level | Examples | Action | | -------- | ----------------------------------- | ---------------- | | Critical | Exposed secrets, RCE, SQL injection | Block deployment | | High | XSS, CSRF, auth bypass | Fix before merge | | Medium | Insecure cookies, weak crypto | Fix in sprint | | Low | Info disclosure, best practices | Track for later |

Step 5: Generate Report

Format findings clearly:

## Security Scan Report

### Critical (2)

#### 1. Hardcoded API Key

- **File**: src/api/client.ts:42
- **Pattern**: `apiKey = "sk_live_..."`
- **Risk**: Credential exposure in source control
- **Fix**: Move to environment variable

```typescript
// Before
const apiKey = "sk_live_abc123...";

// After
const apiKey = process.env.API_KEY;
```

2. SQL Injection Risk

File: src/db/users.ts:23
Pattern: String concatenation in query
Risk: SQL injection allows data theft
Fix: Use parameterized queries

// Before
db.query(`SELECT * FROM users WHERE id = ${userId}`);

// After
db.query("SELECT * FROM users WHERE id = $1", [userId]);

High (1)

1. XSS via dangerouslySetInnerHTML

File: src/components/Article.tsx:15
Risk: User content rendered as HTML
Fix: Sanitize with DOMPurify

import DOMPurify from "dompurify";
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(content) }} />;

Summary

| Severity | Count | | -------- | ----- | | Critical | 2 | | High | 1 | | Medium | 3 | | Low | 5 |


## Common Remediation Patterns

**Environment variables for secrets:**
```typescript
// Use dotenv or platform env
const secret = process.env.SECRET_KEY;
if (!secret) throw new Error('SECRET_KEY required');

Parameterized queries:

// Prisma (safe by default)
await prisma.user.findUnique({ where: { id: userId } });

// Raw SQL with parameters
await db.query("SELECT * FROM users WHERE id = $1", [userId]);

XSS prevention:

// React - avoid dangerouslySetInnerHTML
// If needed, sanitize first
import DOMPurify from "dompurify";
const clean = DOMPurify.sanitize(userContent);

CSRF protection:

// Use CSRF tokens in forms
<input type="hidden" name="_csrf" value={csrfToken} />

// Validate on server
if (req.body._csrf !== req.session.csrfToken) {
  throw new Error('CSRF validation failed');
}

Secure headers:

// Next.js next.config.js
const securityHeaders = [
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "X-Frame-Options", value: "DENY" },
  { key: "X-XSS-Protection", value: "1; mode=block" },
  {
    key: "Strict-Transport-Security",
    value: "max-age=31536000; includeSubDomains",
  },
];

Validation

Before completing:

[ ] All critical issues addressed
[ ] High severity issues have remediation plan
[ ] No secrets in committed code
[ ] Dependencies updated for known CVEs
[ ] Security headers configured

Error Handling

Scanner not installed: Run npm install -g <tool> or use npx.
Too many results: Filter by severity or scope to changed files.
False positives: Review context before reporting; exclude test fixtures.
Unsure about severity: Default to higher severity; security errs on caution.

detecting-security-vulnerabilities