Security Analysis Skill

Provides expertise in detecting security threats, malicious patterns, and privacy violations in codebases.

Purpose

Equip agents with patterns and techniques for:

• Detecting malicious code patterns and data exfiltration
• Identifying privacy-violating behaviors
• Assessing codebase security risks
• Generating actionable security reports

When to Use

• Auditing newly cloned repositories before running locally
• Reviewing code for security vulnerabilities
• Analyzing dependencies for suspicious behavior
• Generating security report cards

Detection Categories

Network and Data Exfiltration

Patterns indicating unauthorized data transmission:

• Outbound HTTP/HTTPS requests to external URLs
• WebSocket connections to unknown endpoints
• DNS lookups to suspicious domains
• Email sending capabilities
• File upload mechanisms
• Encoded/encrypted data transmission
• Hardcoded IP addresses or domains

File System Access

Patterns indicating sensitive file access:

• Reading credential files (~/.ssh, ~/.aws, ~/.env, tokens)
• Accessing browser data (cookies, history, saved passwords)
• Reading system configuration files
• Unexpected file write operations
• Access to other applications' data directories

Code Execution Risks

Patterns enabling arbitrary code execution:

• eval(), exec(), or dynamic code execution
• Shell command execution (child_process, subprocess, os.system)
• Dynamic imports or require statements
• Deserialization of untrusted data
• Template injection vulnerabilities

Obfuscation and Evasion

Patterns hiding malicious intent:

• Base64 encoded strings (especially URLs or commands)
• Hex-encoded payloads
• String concatenation to hide keywords
• Minified code without source maps
• Encrypted or packed code sections
• Anti-debugging techniques

Credential and Secret Handling

Patterns exposing sensitive data:

• Hardcoded API keys, tokens, or passwords
• Environment variable access patterns
• Keychain/credential store access
• Clipboard monitoring

Report Card Scoring

Generate a letter grade from A to F:

Risk Classification

Critical (Immediate Report)

• Clear evidence of malicious code
• Active data exfiltration mechanisms
• Credential theft patterns
• Remote code execution backdoors

High Risk

• Multiple suspicious patterns combined
• Obfuscated network communication
• Unauthorized file access to sensitive paths
• Install/postinstall scripts with shell execution

Medium Risk

• Single suspicious pattern with legitimate use case possible
• Overly broad file access permissions
• Deprecated security practices

Low Risk

• Minor security hygiene issues
• Missing best practices
• Informational findings

Analysis Principles

• Context matters: A network library making HTTP requests is expected; a date formatter doing so is suspicious
• Minimize false positives: Distinguish between capability and intent
• Consider attack chains: Multiple low-severity findings may combine into high-severity risks
• Preserve evidence: Include exact file paths, line numbers, and code snippets for all findings
• Fail fast on critical: If clear malicious code is found, report immediately

Output Format

Structure findings as:

1. Executive Summary: 2-3 sentence overview
2. Overall Score: Letter grade with numeric score
3. Risk Categories: Rating per category (Low/Medium/High/Critical)
4. Critical Findings: Highest-severity issues with evidence
5. Warnings: Medium-severity items
6. Informational: Low-severity or contextual findings
7. Recommendations: Specific mitigation actions
8. Safe to Run?: Clear YES/NO/CONDITIONAL verdict

Additional Resources

Reference Files

For detailed patterns, consult:

• references/detection-patterns.md - Comprehensive regex and grep patterns