Security Guardian Pro: Full-Stack Security Audit

Problem

Security Guardian Pro targets developer-owned local code and explicitly authorized systems. It addresses loose audit workflows where finding dangerous functions with Grep is not enough. The skill connects the tech stack, input points, auth middleware, file uploads, CORS, and security headers into a reviewable evidence trail. It also keeps the work inside defensive boundaries, avoiding unauthorized penetration testing, user-data export, or generation of working exploit code.

How It Works

The skill behaves like a defensive application security architect and follows four phases:
- Reconnaissance: use Glob for dependencies, routes, and query patterns; use Grep for weak patterns; if allowed, run gitleaks detect --no-git -v to detect hardcoded credentials.
- Scan and enumerate: if Bash is available, run semgrep --config=auto --json .; then inspect input sources such as req.query, req.body, and @RequestParam one by one.
- Harmless verification: create low-risk checks for SQLi, command injection, SSRF, XSS, and IDOR, such as SELECT version(), whoami, or out-of-band callbacks, and include request/response snippets plus a harmless-use statement.
- Reporting and compliance mapping: identify relevant regulations, risks, and remediation directions; use WebSearch / WebFetch to check CVEs and security advisories for suspicious dependencies.

Boundaries

It fits code review, SAST, credential-leak checks, and DevSecOps validation, but not unauthorized testing. For third-party systems, written authorization must be confirmed first. Real secrets should be masked, such as AKIA****, and users should rotate them. It should not generate exploits, phishing pages, social-engineering scripts, or complete usable attack code.