# Skill: Vulnerability Assessment

Identify and assess security vulnerabilities in code and systems.

## Capabilities
- Code security review
- OWASP Top 10 detection
- CWE categorization
- Risk assessment
- Remediation guidance
- Security testing

## Vulnerability Patterns

### Injection Vulnerabilities

#### SQL Injection (CWE-89)
```python
# VULNERABLE
query = f"SELECT * FROM users WHERE id = {user_id}"

# SECURE
query = "SELECT * FROM users WHERE id = ?"
cursor.execute(query, (user_id,))
```

#### Command Injection (CWE-78)
```python
# VULNERABLE
os.system(f"process {user_input}")
subprocess.run(f"convert {filename}", shell=True)

# SECURE
subprocess.run(["process", validated_input], shell=False)
```

#### Path Traversal (CWE-22)
```python
# VULNERABLE
with open(os.path.join(base_dir, user_path)) as f:
    return f.read()

# SECURE
base = Path(base_dir).resolve()
target = (base / user_path).resolve()
if not str(target).startswith(str(base)):
    raise ValueError("Invalid path")
```

### Authentication Issues

#### Broken Authentication (CWE-287)
```python
# VULNERABLE - timing attack
if token == stored_token:
    return True

# SECURE - constant time comparison
import secrets
if secrets.compare_digest(token, stored_token):
    return True
```

#### Weak Password Storage (CWE-916)
```python
# VULNERABLE
password_hash = hashlib.md5(password).hexdigest()

# SECURE
import bcrypt
password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt(12))
```

### Data Exposure

#### Sensitive Data Logging (CWE-532)
```python
# VULNERABLE
logger.info(f"User login: {username}, password: {password}")

# SECURE
logger.info(f"User login attempt: {username}")
```

#### Information Leakage (CWE-200)
```python
# VULNERABLE
except Exception as e:
    return {"error": str(e)}  # Leaks stack trace, paths, etc.

# SECURE
except Exception as e:
    error_id = log_error(e)
    return {"error": "An error occurred", "error_id": error_id}
```

## Risk Assessment Matrix

| Severity | Exploitability | Impact | Examples |
|----------|---------------|--------|----------|
| Critical | Easy | Full compromise | RCE, Auth bypass |
| High | Moderate | Data breach | SQLi, Stored XSS |
| Medium | Difficult | Limited access | CSRF, Info disclosure |
| Low | Very difficult | Minimal | Missing headers |

## Security Testing Checklist

### Static Analysis
- [ ] Run Bandit (Python): `bandit -r .`
- [ ] Run Semgrep: `semgrep --config=auto`
- [ ] Check dependencies: `pip-audit`

### Dynamic Testing
- [ ] Test input validation boundaries
- [ ] Test authentication flows
- [ ] Test authorization on all endpoints
- [ ] Test for injection in all inputs
- [ ] Test error handling

## Checklist
- [ ] All inputs validated and sanitized
- [ ] Parameterized queries used
- [ ] No shell=True with user input
- [ ] Secrets not in code or logs
- [ ] Auth uses constant-time comparison
- [ ] Passwords hashed with bcrypt
- [ ] Error messages sanitized
- [ ] Security headers configured
