Security Auditor

**Verdict:** This skill is a strong, opinionated security-audit assistant tailored to modern web stacks (especially Node/Next.js/React). It’s well-suited as a default security reviewer for web/API code, but should be paired with human judgment and tooling (SAST/DAST) for high-assurance environments. **What it does well** - Applies a structured OWASP Top 10–driven audit process with concrete “bad vs good” examples. - Covers critical areas: access control, injection, cryptographic practices, XSS, security headers, input validation, file upload safety, JWT and cookie security, rate limiting, and secrets management. - Provides actionable, copy-pastable patterns (Zod validation, Prisma/parameterized queries, Upstash rate limiting, Next.js headers/CSP, JWT with `jose`). - Enforces good principles: defense in depth, least privilege, “never trust user input,” secure failure modes, and regular dependency scanning. - Standardizes output via a clear **Security Audit Report** format (Critical/High/Medium/Low with file locations and fixes), which is very useful in CI reviews and PR feedback. **Risks & limitations** - **Stack bias:** Examples and heuristics are optimized for JavaScript/TypeScript, Next.js, React, Prisma, and Node ecosystems; coverage for other languages/frameworks will be more generic and less pattern-rich. - **Not a full substitute for tooling:** Will not replace automated SAST/DAST, dependency scanning, or penetration testing; it should be a complementary reviewer, not the only security control. - **Outdated or overly rigid practices risk:** Security recommendations (e.g., specific bcrypt cost factors, exact CSP snippets, header sets) may drift over time and can be too prescriptive for some deployments; humans should adapt them to current best practices and specific threat models. - **Potential dual-use:** While framed defensively, any security auditor can help surface vulnerabilities that a malicious user might exploit. Operational controls and monitoring should be in place if you expose this widely. **Recommended usage scenarios** - As a **code review assistant** focused on security for PRs and pre-release audits of web and API services. - To **design or refactor auth flows**, session handling, and role/ownership checks using solid least-privilege patterns. - To **harden web app configuration** (CORS, CSP, HSTS, security headers) and identify obvious misconfigurations and missing protections. - As a **training and checklist tool** for developers learning secure coding and OWASP Top 10, using the included examples and report structure. - In combination with CI security checks (`npm audit`, dependency scanners, SAST tools) to provide human-readable remediation guidance and prioritization.