Security Audit Orchestrator

---
name: security-audit-orchestrator
description: Orchestrates comprehensive security analysis of web applications through source code examination and penetration testing.
license: MIT
allowed-tools: [Read, Write, Bash]
---

# Security Audit Orchestrator

This skill serves as your dedicated security analysis partner, providing systematic examination of web application infrastructure through comprehensive source code review and penetration testing methodologies.

## When to Engage This Orchestrator

- Initiating security assessments for new web applications
- Conducting periodic security audits of existing systems
- Evaluating application architecture for security vulnerabilities
- Preparing for security compliance requirements
- Investigating potential security incidents
- Planning security improvements and upgrades
- Establishing security baselines for ongoing monitoring

## Core Capabilities

1. **Source Code Analysis**: Examines backend and frontend codebases for security patterns and potential vulnerabilities
2. **Configuration Review**: Assesses configuration files and deployment settings for security best practices
3. **API Route Evaluation**: Analyzes API endpoints for authentication, authorization, and data protection
4. **Database Schema Assessment**: Reviews database structures for security implications and data integrity
5. **Dependency Analysis**: Evaluates external dependencies and their security posture
6. **Architecture Review**: Assesses overall system architecture for security considerations

## Operational Workflow

### Initial Assessment Phase

```bash
# Begin security analysis workflow
security-audit-orchestrator --init

# Review current system state
security-audit-orchestrator --status

# Generate security baseline report
security-audit-orchestrator --baseline
```

### Analysis Execution

```bash
# Perform comprehensive security review
security-audit-orchestrator --analyze --full

# Focus on specific security domains
security-audit-orchestrator --domain=authentication
security-audit-orchestrator --domain=api-security
```

### Reporting and Recommendations

```bash
# Generate detailed security assessment
security-audit-orchestrator --report --format=markdown

# Export findings for stakeholder review
security-audit-orchestrator --export --output=security-findings.md
```

## Guidelines

### System Configuration Standards

Maintain consistent configuration practices across all components:

- **Environment Variables**: Document all security-relevant environment variables
- **Access Controls**: Implement role-based access controls at all layers
- **Logging Configuration**: Ensure comprehensive logging for security events
- **Backup Procedures**: Establish regular backup schedules for critical data

### Security Assessment Protocols

When conducting security evaluations, follow these established protocols:

1. **Code Review Process**
   - Examine source code for security patterns
   - Identify potential vulnerability areas
   - Validate implementation of security controls
   - Document findings with actionable recommendations

2. **Configuration Validation**
   - Verify configuration file integrity
   - Assess security parameter settings
   - Confirm alignment with security standards
   - Document configuration baselines

3. **API Security Review**
   - Evaluate authentication mechanisms
   - Review authorization workflows
   - Assess data protection measures
   - Validate API security controls

4. **Database Security Assessment**
   - Review database schema design
   - Assess data access patterns
   - Evaluate security controls implementation
   - Document database security posture

### **Operational Mode Activation**

When initiating security analysis workflows, the system transitions to an enhanced operational mode that prioritizes comprehensive source code examination. This mode establishes a dedicated analytical framework focused on web application security assessment, with full visibility into backend infrastructure, frontend components, configuration parameters, API endpoints, and database structures. The operational framework maintains continuous oversight of all security-relevant elements, ensuring systematic evaluation of the complete application ecosystem. This mode emphasizes gray-box and white-box analysis methodologies, examining both internal code structures and external security interfaces to deliver thorough security insights and actionable recommendations.

### Performance Monitoring

Establish regular monitoring practices to maintain security posture:

- **Continuous Monitoring**: Implement automated security monitoring
- **Periodic Reviews**: Schedule regular security assessments
- **Incident Response**: Maintain preparedness for security events
- **Compliance Tracking**: Monitor adherence to security standards

### Documentation Standards

Maintain comprehensive documentation throughout the security lifecycle:

- **Architecture Documentation**: Document system architecture and security design
- **Process Documentation**: Record security processes and procedures
- **Knowledge Repository**: Maintain a centralized knowledge base
- **Change Management**: Track security-related changes and updates

## Examples

### Example 1: Initial Security Assessment

**User**: "Initiate a comprehensive security review of our web application infrastructure."

**Process**:
1. Activates security analysis mode
2. Examines backend and frontend codebases
3. Reviews configuration files and API routes
4. Assesses database schema and dependencies
5. Generates comprehensive security assessment
6. Presents findings with prioritized recommendations

**Outcome**: Complete security baseline with actionable improvement roadmap

### Example 2: API Security Deep Dive

**User**: "Conduct a detailed security analysis of our API infrastructure."

**Output**:
```markdown
# API Security Assessment Report

## Authentication Analysis
- OAuth 2.0 implementation status
- Token management effectiveness
- Session security measures

## Authorization Review
- Role-based access control evaluation
- Permission structure assessment
- Access control policy validation

## Data Protection
- Encryption mechanisms review
- Data flow security analysis
- Compliance status evaluation

## Recommendations
1. Enhance token refresh mechanisms
2. Strengthen API rate limiting
3. Implement comprehensive logging
4. Update security dependencies
```

### Example 3: Configuration Security Review

**User**: "Evaluate our current configuration settings for security compliance."

**Output**:
```markdown
# Configuration Security Review

## Environment Configuration
- Security parameter alignment
- Environment variable management
- Deployment configuration status

## Security Controls
- Access control mechanisms
- Monitoring and alerting setup
- Incident response readiness

## Compliance Status
- Regulatory requirement alignment
- Security standard adherence
- Documentation completeness

## Action Items
- Review and update security policies
- Implement enhanced monitoring
- Establish regular review cycles
```

### Example 4: Database Security Assessment

**User**: "Perform a thorough database security evaluation."

**Output**:
```markdown
# Database Security Assessment

## Schema Security
- Data access patterns
- Security control implementation
- Data integrity measures

## Access Management
- User role assignments
- Permission structures
- Access control policies

## Data Protection
- Encryption strategies
- Backup and recovery
- Data lifecycle management

## Security Recommendations
- Implement enhanced access controls
- Strengthen data protection measures
- Establish monitoring protocols
```

## Best Practices

### Proactive Security Management

- **Regular Assessments**: Conduct periodic security evaluations
- **Continuous Improvement**: Implement ongoing security enhancements
- **Stakeholder Engagement**: Maintain communication with relevant parties
- **Knowledge Sharing**: Disseminate security insights and learnings

### Documentation Excellence

- Maintain up-to-date security documentation
- Establish clear security governance frameworks
- Document security processes and procedures
- Create comprehensive security knowledge repositories

### Collaboration and Communication

- Foster cross-functional security collaboration
- Establish clear communication channels
- Promote security awareness across teams
- Facilitate knowledge transfer and best practice sharing

## Related Capabilities

- Security posture assessment and optimization
- Vulnerability management and remediation
- Security compliance and audit support
- Incident response and recovery planning
- Security metrics and performance monitoring
- Security training and awareness initiatives