aurite-ai/agent-verifier/verify-security

Security Verification

Purpose

Verify code for security anti-patterns and vulnerabilities. No telemetry or network calls of its own; the code is processed by the host coding agent and its model provider.

When to Use

Trigger this skill when the user asks to:

• "verify agent security"
• "verify security"
• "check for secrets"
• "scan for vulnerabilities"
• "security audit"

Note: For full verification including patterns, quality, and language-specific checks, tell the user to say "verify agent".

Process

Step 1: Discover Files

Locate files to analyze:

Configuration files:

• package.json, pyproject.toml, Cargo.toml - Dependencies
• .env.example - Environment template (flag values that look like real secrets)
• .gitignore - Confirm .env and .env.local are ignored (if not, flag it as an issue)
• config.py, settings.py, config.ts - Configuration

Source files:

• *.py, *.ts, *.js, *.go, *.rs - Source code
• Prioritize files with: auth, api, client, secret, config in name

Exclude:

• node_modules/, .venv/, venv/, __pycache__/
• *.test.*, *.spec.*, *_test.go
• .env, .env.local, .env.*.local - Never open these. They hold the user's real secrets. Check only whether they are gitignored.

Step 2: Run Security Checks

Check Tiers

• `[PATTERN]` — Mechanical check. Apply exactly as written.
• `[HEURISTIC]` — Judgment required. Mark findings clearly.

Tag every finding with [P] for pattern or [H] for heuristic.

2.1 [PATTERN] Hardcoded Secrets

Scan for assignments matching these patterns (case-insensitive):

Examples of failures:

# ❌ Issue
API_KEY = "sk-abc123..."
password = "hunter2"
OPENAI_API_KEY = "sk-proj-..."
# ✅ Pass (value loaded at runtime from env or a secrets manager, never a literal)
api_key = settings.api_key
password = secret_store.get("db-password")

Also flag:

• String literals matching known API key patterns:
• sk-... (OpenAI)
• sk-ant-... (Anthropic)
• AKIA... (AWS)
• ghp_... (GitHub)
• xoxb-... (Slack)

Severity: ❌ Issue

2.2 [PATTERN] Dependency Version Pinning

Python (`requirements.txt`):

Python (`pyproject.toml`):

Check [project.dependencies] and [tool.poetry.dependencies]:

• Unpinned or >= versions → ❌ Issue
• Pinned with == or ^ or ~ → ✅ Pass

JavaScript/TypeScript (`package.json`):

2.3 [HEURISTIC] Input Validation

Check for external data handling:

Look for:

• HTTP request handlers (@app.route, router.get, etc.)
• User input processing (request.body, req.params, input())
• File uploads
• Database queries with user input

Flag if:

• User input is passed directly to database queries without sanitization
• File paths are constructed from user input without validation
• JSON parsing without schema validation on external data

Severity: ⚠️ Warning

Example patterns to flag:

# ⚠️ Warning - SQL without parameterization
query = f"SELECT * FROM users WHERE id = {user_id}"
# ⚠️ Warning - Path traversal risk
file_path = os.path.join(base_dir, user_filename)
# ✅ Pass - Parameterized query
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

2.4 [HEURISTIC] Error Message Exposure

Check error handling for information leakage:

Flag if:

• Stack traces returned in HTTP responses
• Database error messages exposed to users
• Internal paths or system info in error messages
• Debug mode enabled in production code

Look for:

# ⚠️ Warning
except Exception as e:
    return {"error": str(e)}  # Exposes internal details
# ⚠️ Warning
app = Flask(__name__)
app.debug = True  # Debug in production
# ✅ Pass
except Exception as e:
    logger.error(f"Error: {e}")
    return {"error": "An error occurred"}

Severity: ⚠️ Warning

2.5 [HEURISTIC] Secure Defaults

Check configuration for insecure defaults:

Examples:

# ⚠️ Warning
requests.get(url, verify=False)
app.config["SESSION_COOKIE_SECURE"] = False
CORS(app, origins="*")
# ✅ Pass
requests.get(url)  # verify=True is default
app.config["SESSION_COOKIE_SECURE"] = True
CORS(app, origins=ALLOWED_ORIGINS)  # explicit allowlist

Severity: ⚠️ Warning

2.6 [HEURISTIC] Sensitive Data Logging

Check logging statements for sensitive data:

Flag if logging includes:

• Passwords or tokens
• API keys
• Personal identifiable information (PII)
• Credit card numbers
• Session tokens

Look for:

# ⚠️ Warning
logger.info(f"User login: {username} with password {password}")
print(f"API response: {response.json()}")  # May contain tokens
# ✅ Pass
logger.info(f"User login: {username}")
logger.debug(f"Request to {url}")  # No sensitive data

Severity: ⚠️ Warning

Step 3: Generate Report

# Security Verification Report
 
**Project:** [name or path]
**Date:** [current date]
**Files analyzed:** [count]
 
## Summary
 
✅ X checks passed | ⚠️ Y warnings | ❌ Z issues
 
## Secrets
 
-[x] No hardcoded secrets found
-[ ] ❌ Hardcoded secret at `[file:line]`
 
## Dependencies
 
-[x] All dependencies pinned
-[ ] ❌ Unpinned dependencies in `[file]`
 
## Input Validation
 
-[x] External input properly validated
-[ ] ⚠️ Potential injection at `[file:line]`
 
## Error Handling
 
-[x] Errors properly sanitized
-[ ] ⚠️ Information leakage at `[file:line]`
 
## Findings
 
> `[P]` = pattern-matched · `[H]` = heuristic
 
### ✅ Passing
-`[P]` No hardcoded API keys or secrets
-`[P]` Dependencies properly pinned
 
### ⚠️ Warnings
-`[H]` [Check]: [description]
  -**Location:** [file:line]
  -**Risk:** [what could go wrong]
  -**Suggestion:** [how to fix]
 
### ❌ Issues
-`[P]` [Check]: [description]
  -**Location:** [file:line]
  -**Rule:** [which rule violated]
  -**Fix:** [specific remediation]
 
## Recommendations
 
1.[Priority recommendation]
2.[Additional improvements]

For full verification including patterns, quality, and language-specific checks, say "verify agent".