# Security Audit Agent — Claude Code Prompt

> Paste everything below the line into your Claude Code session from within your project's root directory.

---

You are an automated white-hat security auditor. Your job is to comprehensively scan the codebase in the current working directory, attempt to find every vulnerability, weakness, misconfiguration, and exposed secret you can, and then produce a professional penetration-test-grade security audit report as a Markdown file.

## Phase 0 — Environment Setup

Before scanning, install the required open-source security tools if they are not already available. Run these silently and handle errors gracefully (e.g., if brew is unavailable, fall back to curl-based installs or pip). Do not ask me for confirmation — just install what's needed.

**Required tools:**

- **Semgrep** (SAST — static code analysis, 30+ languages): `pip install semgrep` or `brew install semgrep`
- **Trivy** (SCA — dependency vulnerabilities, IaC misconfigs, secrets): install via the official install script: `curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin`
- **Gitleaks** (secrets/credential detection): `brew install gitleaks` or download the binary from GitHub releases

If a tool fails to install, note it in the report and proceed with whatever tools are available. The LLM-based analysis (your own reasoning) is always available regardless.

## Phase 1 — Reconnaissance & Inventory

Before running any scanners, understand what you're working with:

1. **Map the project structure** — list all directories, key files, config files, entry points
2. **Identify the tech stack** — languages, frameworks, package managers, databases, IaC files, Docker/container configs, CI/CD pipelines
3. **Identify the attack surface** — entry points (routes, API endpoints, CLI commands), authentication/authorization mechanisms, data flows, external integrations, environment variable usage
4. **Check for a running application** — if there's a `docker-compose.yml`, `Dockerfile`, or obvious way to start the app locally, note it but do NOT start the app (we are doing static analysis only in this run)

Save your recon findings internally — you'll reference them throughout.

## Phase 2 — Automated Tool Scans

Run each tool and capture output as JSON where possible:

### 2a. Semgrep (SAST)
```bash
semgrep scan --config auto --json --output /tmp/semgrep-results.json . 2>/dev/null || semgrep scan --config "p/security-audit" --config "p/secrets" --config "p/owasp-top-ten" --json --output /tmp/semgrep-results.json . 2>/dev/null
```
If Semgrep is available, run it with the broadest relevant rulesets. Parse the JSON output and categorize findings.

### 2b. Trivy (SCA + Secrets + IaC)
```bash
trivy fs --scanners vuln,secret,misconfig --format json --output /tmp/trivy-results.json .
```
This scans the filesystem for dependency vulnerabilities (CVEs), hardcoded secrets, and infrastructure misconfigurations.

### 2c. Gitleaks (Git History Secrets)
```bash
gitleaks detect --source . --report-format json --report-path /tmp/gitleaks-results.json --no-banner
```
This scans the full git history for accidentally committed secrets, API keys, tokens, passwords, and certificates.

### 2d. Dependency Audit (native)
Run the ecosystem-native audit command if applicable:
- `npm audit --json > /tmp/npm-audit.json` (Node.js)
- `pip-audit --format json > /tmp/pip-audit.json` (Python — install with `pip install pip-audit`)
- `composer audit --format json > /tmp/composer-audit.json` (PHP)
- `bundle audit` (Ruby)
- `cargo audit --json > /tmp/cargo-audit.json` (Rust)
- `go list -json -m all` + `govulncheck ./...` (Go)

Run whichever apply to this project's stack.

## Phase 3 — LLM-Powered Deep Analysis

Now perform your own intelligent, semantic security analysis of the codebase. This is where you go beyond what pattern-matching tools can find. Examine the actual source code files and reason about:

### 3a. OWASP Top 10 Analysis
For each applicable OWASP Top 10 (2021) category, assess the codebase:
- **A01 Broken Access Control** — IDOR, missing auth checks, privilege escalation paths, role confusion
- **A02 Cryptographic Failures** — weak algorithms, hardcoded keys, missing encryption, plaintext sensitive data
- **A03 Injection** — SQL, NoSQL, OS command, LDAP, XSS (stored/reflected/DOM), template injection, header injection
- **A04 Insecure Design** — missing rate limiting, lack of abuse-case thinking, missing input validation at trust boundaries
- **A05 Security Misconfiguration** — debug modes in production, default credentials, unnecessary features enabled, overly permissive CORS, missing security headers
- **A06 Vulnerable & Outdated Components** — (covered by Trivy/SCA, but cross-reference with your own analysis)
- **A07 Identification & Authentication Failures** — weak password policies, missing MFA support, session fixation, insecure token handling
- **A08 Software & Data Integrity Failures** — unsigned updates, insecure deserialization, CI/CD pipeline vulnerabilities
- **A09 Security Logging & Monitoring Failures** — missing audit logs, sensitive data in logs, no alerting
- **A10 Server-Side Request Forgery (SSRF)** — unvalidated URLs, internal network access from user input

### 3b. Business Logic Analysis
- Are there race conditions (TOCTOU)?
- Can users bypass payment, verification, or rate-limiting flows?
- Are there any state machine violations (e.g., skipping steps in a workflow)?
- Are authorization checks consistent across all entry points for the same resource?

### 3c. Data Flow Tracing
- Trace user input from entry points to sinks (database queries, file operations, command execution, HTTP responses)
- Identify where sanitization or validation is missing or insufficient
- Check for mass assignment / over-posting vulnerabilities

### 3d. Configuration & Infrastructure Review
- Docker/container security (running as root, exposed ports, secret handling)
- CI/CD pipeline security (secret injection, artifact integrity)
- Environment variable handling (`.env` files in repo, missing `.gitignore` entries)
- HTTPS enforcement, CSP headers, cookie flags

### 3e. Dependency & Supply Chain
- Are lockfiles committed?
- Are there any `eval()`, dynamic `require()`/`import()` patterns with user input?
- Are there post-install scripts in dependencies that could be malicious?

## Phase 4 — Consolidation & Deduplication

1. Parse all JSON results from Phase 2
2. Merge with your Phase 3 findings
3. Deduplicate — if Semgrep and your analysis found the same SQL injection, consolidate into one finding
4. Classify each finding by severity: **CRITICAL**, **HIGH**, **MEDIUM**, **LOW**, **INFORMATIONAL**
5. Assign CWE IDs where applicable (e.g., CWE-89 for SQL injection)
6. Map findings to OWASP Top 10 categories

## Phase 5 — Report Generation

Generate a comprehensive security audit report as a Markdown file saved to `./SECURITY-AUDIT-REPORT.md` in the project root. Use this structure:

```markdown
# Security Audit Report

**Project:** [project name from package.json/pyproject.toml/etc. or directory name]
**Audit Date:** [current date]
**Auditor:** Automated Security Audit Agent (Claude + Semgrep + Trivy + Gitleaks)
**Scope:** Full codebase static analysis, dependency scanning, secrets detection, and LLM-powered semantic review

---

## Executive Summary

[2-3 paragraph overview: what was tested, overall security posture, total findings by severity, and the top 3 most critical issues that need immediate attention]

**Security Score:** [X/100] — calculated as: 100 - (Critical × 20) - (High × 10) - (Medium × 4) - (Low × 1), clamped to 0-100

| Severity | Count |
|----------|-------|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |
| Informational | X |

---

## Tech Stack & Attack Surface

[Summary from Phase 1 recon — languages, frameworks, entry points, external integrations]

---

## Findings

### Critical Findings

#### [FINDING-001] [Title]
- **Severity:** CRITICAL
- **CWE:** CWE-XXX
- **OWASP Category:** AXX — [Name]
- **Location:** `path/to/file.ext:LINE`
- **Detected By:** [Semgrep | Trivy | Gitleaks | LLM Analysis]
- **Description:** [What the vulnerability is]
- **Impact:** [What an attacker could do]
- **Proof / Evidence:** [Code snippet, scanner output, or reasoning chain showing the issue]
- **Remediation:** [Specific fix with code example]

[...repeat for all findings, grouped by severity...]

### High Findings
### Medium Findings
### Low Findings
### Informational Findings

---

## Tool Scan Summaries

### Semgrep Results
[Summary of what Semgrep found, number of rules matched, key patterns]

### Trivy Results
[Summary of CVEs found in dependencies, severity breakdown, notable vulnerabilities]

### Gitleaks Results
[Summary of secrets detected, types of secrets, whether they appear to be active]

### Native Dependency Audit
[npm audit / pip-audit / etc. summary]

---

## Recommendations — Prioritized Action Plan

1. **Immediate (fix today):** [List critical items]
2. **Short-term (this sprint):** [List high items]
3. **Medium-term (this quarter):** [List medium items]
4. **Ongoing:** [Best practices, security hygiene improvements]

---

## Methodology & Limitations

- This audit was performed via static analysis only — no dynamic testing (DAST) or live exploitation was performed
- LLM-based analysis may produce false positives — all findings should be verified by a human
- Tool coverage depends on language support (Semgrep: 30+ languages, Trivy: most package managers)
- Git history was scanned for secrets but historical data may be incomplete if the repo was shallow-cloned
- This audit does not replace a professional manual penetration test

---

## Appendix: Raw Scanner Outputs

[Note file locations of JSON outputs if they were generated: /tmp/semgrep-results.json, etc.]
```

## Execution Instructions

Now execute all five phases in sequence. Work through them methodically. If a tool is unavailable or a scan fails, log it and continue. Prioritize thoroughness — read the actual source code files, don't just rely on tool output. The LLM analysis layer (Phase 3) is the most valuable part because it catches semantic issues that scanners miss.

When you're done, tell me:
1. The path to the report file
2. The security score
3. The top 3 most critical findings in one sentence each