---
name: forge-security-audit
description: >
  Security review of source code - detect vulnerabilities (SQL injection, XSS, CSRF, SSRF, RCE), secrets, config issues.
  Trigger when user types /forge-security-audit or requests a security audit/review.
---

# /forge-security-audit

Security review of source code using AI reasoning.

## Command

```
/forge-security-audit [path] [--quick|--deep] [--markdown|--json] [--verbose]
```

### Options

- `[path]` — Target directory (default: current directory)
- `--quick` — Fast scan, focus on critical issues only
- `--deep` — Thorough scan, check all patterns
- `--markdown` — Output as markdown (default)
- `--json` — Output as JSON
- `--verbose` — Include detailed evidence

## Purpose

Analyze source code for:
- Security vulnerabilities (SQL Injection, XSS, CSRF, SSRF, RCE)
- Hardcoded secrets (API keys, tokens, passwords)
- Configuration issues (CORS, debug mode, JWT)
- Infrastructure security (Dockerfile, K8s, CI/CD)

## Workflow

### Step 1: Understand Project

Use `shared/analyzer/` to detect:
- Repository type
- Primary language
- Framework
- Project structure

### Step 2: Run Security Analysis

Execute analysis prompts in order:
1. Secrets Detection (`prompts/secrets-detection.md`)
2. Source Code Review (`prompts/source-code-review.md`)
3. Configuration Review (`prompts/config-review.md`)
4. Infrastructure Review (`prompts/infrastructure-review.md`)

### Step 3: Classify Findings

For each finding:
- Assign severity: Critical, High, Medium, Low, Info
- Assign confidence: High, Medium, Low
- Include evidence (file, line, code snippet)

### Step 4: Generate Report

Use `shared/report/` to generate:
- Security Score (0-100)
- Severity-grouped findings
- Recommendations
- Next steps

## Output Format

Follow the markdown report format generated by `shared/report/markdown.ts`. It MUST use the following layout:

# Security Audit Report

**Project:** [Project Name]  
**Path:** [Project Path]  
**Language:** [Primary Language]  
**Framework:** [Detected Framework (optional)]  
**Date:** [Timestamp]  

## Score

**[Score]/100** (Grade: [Grade])

| Severity | Count |
| :--- | :--- |
| 🔴 Critical | [count] |
| 🟠 High | [count] |
| 🟡 Medium | [count] |
| 🔵 Low | [count] |
| ⚪ Info | [count] |

## Executive Summary

Found **[total]** issues: **[count]** critical, **[count]** high, **[count]** medium, **[count]** low, **[count]** info.

## 🔍 Detailed Findings

### [Severity Group (e.g. 🔴 Critical)]

| Title | Location | Description | Impact |
| :--- | :--- | :--- | :--- |
| **[Finding Title]** | `[file-name]:[line]` | [Description] | [Impact] |

#### 📂 Code Evidence
##### **Finding #[number]: [Finding Title]**
```[language]
[code snippet]
```

## Integration with Shared Components

```typescript
import { analyzeRepository, detectFrameworks } from "../../shared/analyzer";
import { createFinding, classifyFinding } from "../../shared/findings";
import { calculateScore, generateMarkdownReport } from "../../shared/report";
```

## Confidence Levels

- **High**: Pattern match with clear evidence
- **Medium**: Likely issue, needs verification
- **Low**: Possible issue, context-dependent