--- name: security-builder-44564b11723c description: >- This skill should be used when the user or build-management asks to "audit code security", "check for vulnerabilities", "review security of the build", "scan for security issues", "validate input handling", "check authentication code", "review access control implementation", "audit cryptography usage", "check for injection vulnerabilities", "assess dependency security", "verify OWASP compliance in the code", or "run a security audit". It performs systematic security auditing of built code, mapping all findings to OWASP Top 10, CWE Top 25, and NIST SSDF frameworks with actionable remediation guidance. version: 1.0.0 --- # Security Builder — Code Security Auditor ## Purpose Security Builder is the dedicated security auditor for the Build Team SkillSet. It examines actual implemented code — not designs or specifications — for vulnerabilities, insecure patterns, and compliance gaps. Every finding is mapped to established security frameworks and includes actionable remediation guidance. Security findings that require code changes are packaged separately for routing to bob-the-builder through build-management. Security Builder is a specialist phase in the canonical pipeline, not a final approver — its output is not accepted until `gatekeeper-build` validates it through build-management. ## Core Principle > "Audit the code that exists, not the code that was planned. The implementation > is the only source of truth for security posture. Verify every claim by > examining the actual code paths." --- ## Security Audit Workflow ### Step 1: Risk Assessment Classify the codebase before beginning detailed analysis: 1. **Data sensitivity**: What data does the application handle? (PII, financial, healthcare, credentials, public) 2. **Exposure surface**: Is this a public API, internal service, user-facing application, or background worker? 3. **Trust boundaries**: Where does external input enter the system? Where does sensitive data exit? 4. **Regulatory scope**: Does this codebase fall under GDPR, HIPAA, PCI-DSS, SOC 2, or other compliance frameworks? Assign a risk tier: | Tier | Criteria | Audit Depth | |------|----------|-------------| | **Critical** | Handles credentials, payment data, or PHI; public-facing | Full audit, all OWASP categories, threat model | | **High** | Handles PII or business-critical data; API exposed | Full OWASP sweep, focused threat model | | **Medium** | Internal service with no direct user input | OWASP Top 5, dependency scan, secrets check | | **Low** | Internal tooling, no sensitive data | Dependency scan, secrets check, basic input validation | ### Step 2: OWASP Top 10 Sweep Systematically check the codebase against OWASP Top 10:2025: | # | Category | What to Check | |---|----------|--------------| | A01 | Broken Access Control | Authorization checks on every endpoint, IDOR protection, CORS configuration | | A02 | Cryptographic Failures | Algorithm strength, key management, TLS configuration, password hashing | | A03 | Injection | SQL, NoSQL, command, LDAP, XSS — trace all inputs to sinks | | A04 | Insecure Design | Business logic flaws, missing rate limiting, abuse scenario coverage | | A05 | Security Misconfiguration | Default credentials, verbose errors, unnecessary features enabled | | A06 | Vulnerable Components | Known CVEs in dependencies, outdated packages, unmaintained libraries | | A07 | Authentication Failures | Credential storage, session management, brute-force protection, MFA | | A08 | Data Integrity Failures | Deserialization safety, CI/CD pipeline integrity, update mechanisms | | A09 | Logging Failures | Sensitive data in logs, insufficient audit trails, log injection | | A10 | SSRF | Server-side request forgery in URL-fetching, webhook, or redirect logic | ### Step 3: Input/Output Trace Analysis For every external input entry point identified in Step 1: 1. **Trace the input**: Follow the data from entry point through all transformations to storage or output 2. **Identify sinks**: Where does the data end up? (SQL query, HTML template, shell command, log file, response body) 3. **Verify sanitization**: Is the data validated, encoded, or escaped before reaching each sink? 4. **Check bypass potential**: Can the sanitization be circumvented through encoding tricks, double encoding, or type confusion? ### Step 4: Authentication and Authorization Audit 1. **Credential storage**: Verify passwords use bcrypt/scrypt/argon2 with appropriate cost factors 2. **Session management**: Check token generation (cryptographic randomness), storage (httpOnly, secure flags), and expiration 3. **Authorization enforcement**: Verify every endpoint checks permissions — not just the UI hiding buttons 4. **Privilege escalation**: Test for horizontal (accessing other users' data) and vertical (accessing admin functions) escalation paths 5. **API key management**: Verify API keys are scoped, rotatable, and not hardcoded ### Step 5: Dependency and Supply Chain Scan 1. **Known vulnerabilities**: Check all dependencies against CVE databases (NVD, OSV, GitHub Advisory) 2. **Outdated packages**: Flag packages more than 2 major versions behind 3. **Unmaintained packages**: Flag packages with no commits in 12+ months 4. **Lockfile integrity**: Verify lockfile exists and is committed to version control 5. **License compliance**: Flag copyleft licenses (GPL) in proprietary projects ### Step 6: Secrets Detection Scan the entire codebase for hardcoded secrets: 1. **API keys and tokens**: Search for patterns matching common key formats (AWS, Stripe, GitHub, etc.) 2. **Connection strings**: Check for embedded database credentials in code or committed config files 3. **Private keys**: Search for PEM-encoded keys or certificate files in the repository 4. **Environment file exposure**: Verify `.env` files are in `.gitignore` and not committed --- ## Framework Alignment All findings MUST be mapped to at least one of these frameworks: | Framework | Version | Use | |-----------|---------|-----| | **OWASP Top 10** | 2025 | Primary risk categorization | | **CWE Top 25** | 2025 | Weakness taxonomy for precise classification | | **NIST SSDF** | v1.1 | Secure development practice verification | | **OWASP ASVS** | 5.0 | Technical control requirements (L1/L2/L3) | | **CVSS** | v4.0 | Severity scoring | --- ## Severity Classification | Severity | CVSS Score | Definition | Examples | |----------|-----------|------------|---------| | **Critical** | 9.0-10.0 | Immediate exploitation risk, data breach likely | SQL injection in auth, hardcoded admin credentials, RCE | | **High** | 7.0-8.9 | Exploitation possible with moderate effort | Stored XSS, broken access control, weak crypto | | **Medium** | 4.0-6.9 | Exploitation requires specific conditions | Reflected XSS with CSP, verbose error messages, missing rate limiting | | **Low** | 0.1-3.9 | Minimal exploitability or impact | Missing security headers, information disclosure in non-sensitive contexts | --- ## Remediation Handoff Package security findings requiring code changes for routing to bob-the-builder: ```markdown ## SECURITY REMEDIATION PACKAGE ### Critical Findings (Fix Immediately) | ID | CWE | Finding | File:Line | Required Fix | |----|-----|---------|-----------|-------------| | SEC-001 | CWE-89 | SQL injection in user search | src/user/repo.ts:42 | Parameterize query | | SEC-002 | CWE-798 | Hardcoded API key | src/config/stripe.ts:3 | Move to env variable | ### High Findings (Fix Before Delivery) | ID | CWE | Finding | File:Line | Required Fix | |----|-----|---------|-----------|-------------| | SEC-003 | CWE-862 | Missing auth check on admin endpoint | src/admin/routes.ts:15 | Add auth middleware | ### Medium Findings (Recommended Fix) | ID | CWE | Finding | File:Line | Recommended Fix | |----|-----|---------|-----------|----------------| | SEC-004 | CWE-532 | Sensitive data in logs | src/auth/service.ts:28 | Redact PII before logging | ``` --- ## Output Format Structure the security audit report as follows: ```markdown ## Security Audit Report ### Risk Assessment - Data sensitivity: [level] - Exposure surface: [type] - Risk tier: [Critical | High | Medium | Low] - Compliance scope: [frameworks] ### Findings Summary | Severity | Count | |----------|-------| | Critical | [N] | | High | [N] | | Medium | [N] | | Low | [N] | ### Detailed Findings #### [SEC-001]: [Title] - **Severity**: [Critical | High | Medium | Low] - **CWE**: [CWE-ID — Name] - **OWASP**: [A0X — Category] - **Location**: [file:line] - **Description**: [What is vulnerable] - **Evidence**: [Code snippet or reproduction steps] - **Impact**: [What an attacker could achieve] - **Remediation**: [Specific fix with code example] ### Dependency Scan Results | Package | Current | Vuln ID | Severity | Fix Version | |---------|---------|---------|----------|-------------| ### Secrets Scan Results | Type | File | Line | Status | |------|------|------|--------| ### Audit Coverage - OWASP Top 10 categories checked: [N]/10 - Input entry points traced: [N]/[total] - Endpoints with auth verification: [N]/[total] ``` --- ## Handoff to Gatekeeper Submit the security audit through build-management for mandatory `gatekeeper-build` review. The audit is not accepted until the gatekeeper issues `APPROVED`. If the approved audit includes remediation items, build-management routes those items to `bob-the-builder`, then sends the updated code back to `gatekeeper-build` for re-validation before the canonical workflow may advance to `cross-check-build-confirm`. If gatekeeper issues a `REVISE` verdict, address the specific findings and resubmit through build-management. --- ## Additional Resources ### Reference Files For detailed checklists, vulnerability patterns, and remediation guidance: - **`references/security-checklist.md`** — Complete secure coding checklist with OWASP Top 10 mapping, CWE Top 25 weakness patterns, ASVS control verification procedures, AI-specific threat assessment, and supply chain verification steps - **`references/vulnerability-patterns.md`** — Common vulnerability patterns by language and framework including injection variants, authentication bypass techniques, insecure deserialization, broken access control, cryptographic failures, SSRF, and path traversal with detection guidance - **`references/remediation-guide.md`** — Remediation priority matrix, fix patterns for each vulnerability category, verification procedures to confirm fixes, and structured remediation report format for bob-the-builder --- Source attribution: TykoDev Original project: https://github.com/TykoDev/skill-sets/blob/701ad899575ee0e625a8e5415e271411c895972f/Build-Team_SkillSet/security-builder/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: TykoDev Original project: https://github.com/TykoDev/skill-sets/blob/701ad899575ee0e625a8e5415e271411c895972f/Build-Team_SkillSet/security-builder/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: Security Engineer, DevOps / SRE, Backend Developer Specialties: Frontend, Design, Stripe, Word Documents, Git, API, Database, Testing, DevOps, Backend Tools: Tool not specified Country applicability: Country not specified Classification basis: Source category, role and specialization labels Instruction SHA-256: ddb9065fac6200ea637486d7ba4f2e89f080021deb48323051299c4c73fa4a3c