/security:audit [path]
/security:audit                      # Full audit of codebase
/security:audit --owasp              # OWASP Top 10 focus
/security:audit --compliance soc2    # Include SOC2 compliance

# Check available tools
echo "=== Security Tool Inventory ==="
which semgrep trivy gitleaks npm 2>/dev/null || echo "Some tools missing"

# Count files to scan
find . -type f \( -name "*.js" -o -name "*.ts" -o -name "*.py" \) | wc -l

grep -rE "(md5|sha1|DES|RC4|Math\.random)" --include="*.{js,ts,py}"

# SQL Injection
grep -rE "(execute|query|raw).*(\+|\$\{)" --include="*.{js,ts,py}"

# NoSQL Injection
grep -rE "\$where|\$regex" --include="*.{js,ts}"

# Command Injection
grep -rE "(exec|spawn|system|eval)\s*\(" --include="*.{js,ts,py}"

# Check for debug mode
grep -rE "DEBUG\s*=\s*[Tt]rue|NODE_ENV.*development" --include="*.{env,json,yaml}"

# Check CORS configuration
grep -rE "cors|Access-Control" --include="*.{js,ts}"

npm audit --json 2>/dev/null
trivy fs --scanners vuln . 2>/dev/null

# Check for sensitive data in logs
grep -rE "console\.(log|info|debug).*password|secret|token" --include="*.{js,ts}"

# Check URL handling
grep -rE "(fetch|axios|request|http\.get)\s*\(" --include="*.{js,ts}"

# Comprehensive secret patterns
gitleaks detect --source . --report-format json 2>/dev/null || \
grep -rE "(AKIA|sk-|ghp_|gho_|github_pat|xox[baprs]-|hooks\.slack\.com)" \
  --include="*.{js,ts,py,json,yaml,env}"

agent: security-auditor
skills:
  - security-testing
confirmation: none  # Audit is read-only

## Security Audit Report

### Executive Summary
- **Audit Date**: {timestamp}
- **Scope**: {path}
- **Risk Level**: [Critical|High|Medium|Low]

### Findings Summary
| Severity | Count | Status |
|----------|-------|--------|
| Critical | X | Requires immediate action |
| High | X | Address within 7 days |
| Medium | X | Address within 30 days |
| Low | X | Address in next release |

### OWASP Top 10 Assessment
| Category | Status | Findings |
|----------|--------|----------|
| A01 Broken Access Control | ✓/⚠/✗ | [details] |
| A02 Cryptographic Failures | ✓/⚠/✗ | [details] |
| ... | ... | ... |

### Detailed Findings
[Full finding details with evidence and remediation]

### Remediation Roadmap
1. [Immediate: Critical fixes]
2. [Short-term: High priority]
3. [Medium-term: Improvements]

### Compliance Notes
[SOC2/GDPR relevant findings if applicable]