---

name: security description: Secure backend applications against OWASP threats. Implement authentication, encryption, scanning, compliance, and incident response procedures. sasmp_version: "2.0.0" bonded_agent: 07-testing-security bond_type: PRIMARY_BOND

=== PRODUCTION-GRADE SKILL CONFIG (SASMP v2.0.0) ===

atomic_operations:

• VULNERABILITY_SCAN
• AUTH_IMPLEMENTATION
• ENCRYPTION_CONFIG
• COMPLIANCE_CHECK

parameter_validation: query: type: string required: true minLength: 5 maxLength: 2500 security_focus: type: string enum: [owasp, compliance, scanning, auth] required: false compliance_framework: type: string enum: [gdpr, hipaa, pci-dss, soc2] required: false

retry_logic: max_attempts: 2 backoff: exponential initial_delay_ms: 1500

logging_hooks: on_invoke: "skill.security.invoked" on_success: "skill.security.completed" on_error: "skill.security.failed"

exit_codes: SUCCESS: 0 INVALID_INPUT: 1 CRITICAL_VULNERABILITY: 2 COMPLIANCE_VIOLATION: 3

Security Skill

Bonded to: testing-security-agent

---

Quick Start

# Invoke security skill
"Check my code for OWASP vulnerabilities"
"Implement JWT authentication securely"
"Prepare for GDPR compliance audit"

---

Instructions

1. Assess Risks: Identify threats and vulnerabilities
2. Implement Controls: Add authentication, encryption
3. Configure Scanning: Set up SAST, DAST, SCA
4. Ensure Compliance: Meet regulatory requirements
5. Prepare Response: Create incident response plan

---

OWASP Top 10 (2025)

| # | Vulnerability | Prevention | Severity | |---|---------------|------------|----------| | 1 | Broken Access Control | RBAC, least privilege | Critical | | 2 | Cryptographic Failures | Strong encryption, TLS | Critical | | 3 | Injection | Parameterized queries | Critical | | 4 | Insecure Design | Threat modeling | High | | 5 | Security Misconfiguration | Hardening | High | | 6 | Vulnerable Components | SCA scanning | High | | 7 | Auth Failures | MFA, secure sessions | High | | 8 | Data Integrity Failures | Signatures | Medium | | 9 | Logging Failures | Audit logging | Medium | | 10 | SSRF | Input validation | Medium |

---

Security Scanning Tools

| Type | Purpose | Tools | |------|---------|-------| | SAST | Static code | SonarQube, Semgrep | | DAST | Dynamic testing | OWASP ZAP, Burp | | SCA | Dependencies | Snyk, Dependabot | | Container | Images | Trivy, Grype | | Secrets | Detection | GitLeaks, TruffleHog |

---

Examples

Example 1: Secure Authentication

from fastapi import Depends, HTTPException
from fastapi.security import OAuth2PasswordBearer
from passlib.context import CryptContext
from jose import jwt
import secrets

pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

def hash_password(password: str) -> str:
    return pwd_context.hash(password)

def verify_password(plain: str, hashed: str) -> bool:
    return pwd_context.verify(plain, hashed)

def create_token(user_id: str) -> str:
    return jwt.encode(
        {"sub": user_id, "jti": secrets.token_urlsafe(16)},
        SECRET_KEY,
        algorithm="HS256"
    )

Example 2: SQL Injection Prevention

# BAD - Vulnerable to SQL injection
def get_user_bad(user_id: str):
    query = f"SELECT * FROM users WHERE id = '{user_id}'"
    return db.execute(query)

# GOOD - Parameterized query
def get_user_good(user_id: str):
    query = "SELECT * FROM users WHERE id = :id"
    return db.execute(query, {"id": user_id})

Example 3: Security Headers

from fastapi import FastAPI
from starlette.middleware.base import BaseHTTPMiddleware

class SecurityHeadersMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request, call_next):
        response = await call_next(request)
        response.headers["X-Content-Type-Options"] = "nosniff"
        response.headers["X-Frame-Options"] = "DENY"
        response.headers["X-XSS-Protection"] = "1; mode=block"
        response.headers["Strict-Transport-Security"] = "max-age=31536000"
        response.headers["Content-Security-Policy"] = "default-src 'self'"
        return response

app = FastAPI()
app.add_middleware(SecurityHeadersMiddleware)

---

Compliance Checklists

GDPR

• [ ] Lawful basis for processing
• [ ] Data minimization
• [ ] Right to access/deletion
• [ ] Breach notification (72h)
• [ ] DPO if required

PCI-DSS

• [ ] Encrypt cardholder data
• [ ] No CVV storage
• [ ] Access controls
• [ ] Regular testing
• [ ] Audit logging

---

Troubleshooting

Common Issues

| Issue | Cause | Solution | |-------|-------|----------| | Token expired | Short TTL | Implement refresh tokens | | CORS blocked | Missing headers | Configure CORS properly | | Weak encryption | Old algorithms | Use AES-256, RSA-2048+ | | SQL injection | String concat | Use parameterized queries |

Incident Response

Incident Detected
    │
    ├─→ Contain: Isolate affected systems
    ├─→ Assess: Determine scope
    ├─→ Remediate: Fix vulnerability
    ├─→ Recover: Restore services
    └─→ Post-mortem: Document & improve

---

Test Template

# tests/test_security.py
import pytest

class TestSecurityControls:
    def test_password_is_hashed(self):
        password = "secure123"
        hashed = hash_password(password)
        assert password not in hashed
        assert verify_password(password, hashed)

    def test_sql_injection_prevented(self):
        malicious_input = "'; DROP TABLE users; --"
        # Should not execute the DROP TABLE
        result = get_user(malicious_input)
        assert result is None  # User not found, not table dropped

    def test_auth_required_for_protected_routes(self, client):
        response = client.get("/api/v1/users/me")
        assert response.status_code == 401

---

Resources

• OWASP Top 10
• NIST Cybersecurity Framework
• CWE Top 25