/audit

allowed-tools: Task, Read, Bash(rg:*), Bash(fd:*), Bash(jq:*), Bash(gdate:*), Bash(git:*), Bash(docker:*), Bash(trivy:*), Bash(gosec:*), Bash(cargo:*), Bash(mvn:*), Bash(gradle:*), Bash(npm:*), Bash(kubectl:*), Bash(helm:*)
name: "Audit"
description: "Comprehensive security audit with parallel analysis using modern tools and sub-agent coordination"
author: "wcygan"
tags: ["security","audit"]
version: "1.0.0"
created_at: "2025-07-14T00:00:00Z"
updated_at: "2025-07-14T00:00:00Z"

Context

• Session ID: !`gdate +%s%N 2>/dev/null || date +%s%N 2>/dev/null || echo "$(date +%s)$(jot -r 1 100000 999999 2>/dev/null || shuf -i 100000-999999 -n 1 2>/dev/null || echo $RANDOM$RANDOM)"`
• Current directory: !`pwd`
• Project type: !`fd "(package\.json|Cargo\.toml|go\.mod|pom\.xml|build\.gradle|deno\.json|docker-compose\.yml)" . -d 3 | head -5 || echo "No build files detected"`
• Git repository: !`git rev-parse --is-inside-work-tree 2>/dev/null && echo "Yes" || echo "No"`
• Repository files: !`fd . -t f | wc -l | tr -d ' '` files total
• Secret patterns detected: !`rg -i "(password|secret|key|token|api)" --type-add 'config:*.{json,yaml,yml,toml,env,properties}' --type config . | wc -l | tr -d ' '` potential matches
• Docker usage: !`fd "(Dockerfile|docker-compose\.yml|\.dockerignore)" . | wc -l | tr -d ' '` container files
• Kubernetes manifests: !`fd "\.ya?ml$" . | rg -l "(apiVersion|kind):" | wc -l | tr -d ' '` K8s files

Your Task

STEP 1: Initialize comprehensive security audit session

# Create audit session state
echo '{
  "sessionId": "'$SESSION_ID'",
  "timestamp": "'$(gdate -Iseconds 2>/dev/null || date -Iseconds)'",
  "projectType": "auto-detect",
  "auditPhases": {
    "discovery": "pending",
    "analysis": "pending",
    "reporting": "pending"
  },
  "findings": {
    "critical": [],
    "high": [],
    "medium": [],
    "low": []
  },
  "scannedFiles": 0,
  "totalIssues": 0
}' > /tmp/audit-session-$SESSION_ID.json

STEP 2: Parallel security discovery using sub-agent coordination

THINK HARD about the optimal security audit strategy based on project context.

LAUNCH 8 parallel sub-agents for comprehensive security analysis:

• **Agent 1: Credential Scanner**: Search for hardcoded secrets and credentials
• Focus: API keys, passwords, tokens, AWS/GCP/Azure credentials, database strings
• Scope: Source code, configuration files, environment files, Docker files
• Tools: rg with secret patterns, specialized credential detection
• Output: Classified findings by severity and exposure risk

• **Agent 2: Code Security Analyzer**: Language-specific security vulnerability analysis
• Focus: SQL injection, XSS, command injection, deserialization flaws
• Scope: Java (Spring Security), Go (SQL/exec), Rust (unsafe blocks), JavaScript/TypeScript
• Tools: Static analysis patterns, framework-specific security checks
• Output: Code-level vulnerabilities with line numbers and remediation

• **Agent 3: Dependency Vulnerability Scanner**: Third-party dependency security analysis
• Focus: Known CVEs, outdated packages, vulnerable dependencies
• Scope: package.json, Cargo.toml, go.mod, pom.xml, build.gradle
• Tools: Security databases, version checking, vulnerability matching
• Output: Dependency risk assessment with upgrade recommendations

• **Agent 4: Infrastructure Security Auditor**: Container and orchestration security
• Focus: Docker security, Kubernetes RBAC, network policies, secrets management
• Scope: Dockerfiles, K8s manifests, Helm charts, deployment configurations
• Tools: Container scanning, manifest validation, security baseline checks
• Output: Infrastructure security posture with compliance gaps

• **Agent 5: File Permissions Auditor**: File system security and access controls
• Focus: Executable permissions, world-writable files, sensitive file access
• Scope: Shell scripts, configuration files, .ssh directories, backup locations
• Tools: File permission analysis, access control validation
• Output: Permission vulnerabilities and access control recommendations

• **Agent 6: Git Security Scanner**: Version control security analysis
• Focus: Committed secrets, sensitive data in history, branch protection
• Scope: Git history, commit messages, tracked files, gitignore patterns
• Tools: Git log analysis, historical secret detection, repository scanning
• Output: Git security issues with remediation steps

• **Agent 7: Configuration Security Analyzer**: Security configuration assessment
• Focus: Insecure defaults, missing security headers, weak cryptography
• Scope: Application configs, web server configs, database settings, TLS configs
• Tools: Configuration pattern analysis, security baseline comparison
• Output: Configuration hardening recommendations

• **Agent 8: CI/CD Pipeline Security Auditor**: DevOps security analysis
• Focus: Pipeline security, build process vulnerabilities, deployment risks
• Scope: GitHub Actions, GitLab CI, Jenkins files, deployment scripts
• Tools: Pipeline analysis, secret scanning in workflows, deployment validation
• Output: DevOps security improvements and pipeline hardening

**Sub-Agent Coordination Pattern:**

echo "🔍 Launching parallel security audit agents..."
echo "Each agent focuses on specific security domains"
echo "Results will be aggregated into comprehensive report"
echo "Session tracking: /tmp/audit-session-$SESSION_ID.json"

STEP 3: Language-specific security analysis with targeted scanning

TRY:

CASE project_languages: WHEN "Java detected":

# Java security scanning
echo "☕ Java project security analysis"

# Spring Security misconfigurations
rg "@EnableWebSecurity|@PreAuthorize|@Secured" --type java -A 3 -B 1

# SQL injection patterns
rg "(Statement|createStatement|executeQuery)" --type java -A 2

# Deserialization vulnerabilities
rg "(ObjectInputStream|readObject|Serializable)" --type java -A 2

# Dependency check (if available)
if command -