/security-review

name: security-review
description: "OWASP secure design review for code and architecture. Checks input validation, authentication, authorization, data protection."
metadata:
  instruction_budget: "42"
  framework_dependency: "mycelium"
  framework_dependency_note: "This skill is designed to run within the Mycelium framework (https://github.com/haabe/mycelium). Standalone use will skip the canvas state, theory gates, and harness behavior the skill assumes. Install: /plugin install mycelium@haabe-mycelium."

Security Review

Language-agnostic security review based on OWASP Secure by Design.

Checklist (OWASP Top 10:2025)

*Updated to OWASP Top 10:2025 (released January 2025). Previous 2021 edition had different groupings.*

A01:2025 — Broken Access Control

• [ ] Least privilege enforced (users get minimum permissions needed)
• [ ] Authorization checked on EVERY request (not just the first)
• [ ] CORS restrictive (not `*`)
• [ ] Directory listing disabled
• [ ] Rate limiting on API/controller access

A02:2025 — Cryptographic Failures

• [ ] Data encrypted at rest and in transit (TLS 1.2+)
• [ ] No secrets in code, logs, or error messages
• [ ] PII identified and classified in threat model
• [ ] Passwords hashed with bcrypt/argon2 (never MD5/SHA1)
• [ ] Cryptographic algorithms current (no deprecated ciphers)

A03:2025 — Injection

• [ ] All user input validated (type, length, range, format)
• [ ] Parameterized queries for ALL data access (never string concatenation)
• [ ] Input allowlisting preferred over denylisting
• [ ] Output encoded based on context (HTML, JS, URL, CSS — covers XSS)
• [ ] Content Security Policy configured

A03b:2025 — Software Supply Chain Failures *(new in 2025)*

• [ ] SBOM (Software Bill of Materials) maintained for critical dependencies
• [ ] Build integrity verified (reproducible builds, signed artifacts)
• [ ] Dependency provenance checked (not just version, but source authenticity)
• [ ] Transitive dependencies audited (not just direct)
• [ ] Lock files committed and verified

A04:2025 — Insecure Design

• [ ] Threat modeling performed (STRIDE — see /mycelium:threat-model)
• [ ] Secure design patterns used (defense in depth, fail secure)
• [ ] Business logic abuse cases considered
• [ ] Security requirements defined alongside functional requirements

A05:2025 — Security Misconfiguration

• [ ] Default credentials changed
• [ ] Unnecessary features/ports disabled
• [ ] Security headers set (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
• [ ] Error handling does not expose stack traces

A06:2025 — Vulnerable and Outdated Components

• [ ] Dependency audit run (no known critical vulnerabilities)
• [ ] Dependencies pinned to specific versions
• [ ] Automated scanning in CI
• [ ] Unused dependencies removed

A07:2025 — Identification and Authentication Failures

• [ ] Session IDs regenerated on login
• [ ] Multi-factor authentication available for sensitive operations
• [ ] Credential stuffing protections (rate limiting, account lockout)
• [ ] Password strength requirements enforced

A08:2025 — Software and Data Integrity Failures

• [ ] CI/CD pipeline integrity verified (no unsigned code execution)
• [ ] Deserialization inputs validated
• [ ] Software supply chain reviewed (SBOMs for critical dependencies)
• [ ] Auto-update mechanisms use signed packages

A09:2025 — Security Logging and Monitoring Failures

• [ ] Security events logged (login attempts, auth failures, access denials)
• [ ] No sensitive data in logs
• [ ] Alerting on anomalous patterns
• [ ] Logs tamper-resistant (append-only or forwarded to SIEM)

A10:2025 — Server-Side Request Forgery (SSRF)

• [ ] URL inputs validated and allowlisted
• [ ] Internal network access restricted from user-supplied URLs
• [ ] Response content not returned directly to users without sanitization

A10b:2025 — Mishandling of Exceptional Conditions *(new in 2025)*

• [ ] All error paths explicitly handled (no silent failures)
• [ ] Resource exhaustion scenarios addressed (memory, disk, connections)
• [ ] Timeout and retry policies defined for all external calls
• [ ] System fails closed (denies access on error, not grants)

OWASP Top 10 for LLM Applications (2025)

*Apply for `ai_tool` product types. Source: OWASP Top 10 for LLM Applications v2025.1 (genai.owasp.org). Aligned with `/mycelium:threat-model`'s LLM list.*

• [ ] **LLM01 Prompt Injection**: User input (direct or indirect) cannot override system instructions
• [ ] **LLM02 Sensitive Information Disclosure**: PII/secrets/system-prompts not leaked in responses; training data scrubbed
• [ ] **LLM03 Supply Chain**: Model/plugin provenance verified; third-party components audited
• [ ] **LLM04 Data and Model Poisoning**: Training/fine-tuning data sources validated and auditable
• [ ] **LLM05 Improper Output Handling**: LLM output sanitized before downstream use (SQL, shell, HTML)
• [ ] **LLM06 Excessive Agency**: Model actions bounded; least-privilege tools; human-in-the-loop for destructive ops
• [ ] **LLM07 System Prompt Leakage**: System instructions not extractable via adversarial prompts; no secrets in the system prompt
• [ ] **LLM08 Vector and Embedding Weaknesses**: RAG pipelines guarded against poisoned embeddings / retrieval manipulation
• [ ] **LLM09 Misinformation**: Hallucination controls in high-stakes contexts; users informed of limitations
• [ ] **LLM10 Unbounded Consumption**: Rate limits + resource caps against denial-of-wallet / resource exhaustion

OWASP Agentic Skills Top 10 (AST10)

*Apply ONLY when the product under review ships or installs agent skills, plugins, hooks or MCP servers: a skill pack, a coding-agent plugin, an internal skills registry. Skip it otherwise. Source: OWASP Agentic Skills Top 10 (owasp.org/www-project-agentic-skills-top-10), risk pages read 2026-09-17. A young project: treat it as a checklist of where to look, not as a settled standard.*

• [ ] **AST01 Malicious