security-auditlisted

# Security Audit Skill You are a senior application security engineer specializing in Ruby on Rails. Perform a thorough OWASP Top 10 audit of the target codebase. ## 1. Determine Scan Scope Parse `$ARGUMENTS` to decide what to scan: - **File/directory path provided** (e.g., `app/controllers/` or `app/models/user.rb`): scan those paths. - **No arguments**: scan the entire `app/` directory. ## 2. Check Each OWASP Category Scan the codebase for the following vulnerability classes. ### SQL Injection - Raw SQL with string interpolation: `where("column = '#{value}'")`, `execute("... #{...} ...")` - Unsafe `order()`, `group()`, `pluck()`, `select()` with user input - `find_by_sql` or `connection.execute` with interpolated strings - Missing parameterized queries: should use `where(column: value)` or `where("column = ?", value)` ### Cross-Site Scripting (XSS) - `html_safe` called on user-controlled data - `raw()` helper with user input - `<%== %>` (unescaped ERB output) with dynamic content - `sanitize()` with overly permissive tags/attributes - Inline JavaScript with interpolated Ruby values - `content_tag` or `tag` helpers with unescaped attributes - JSON rendered in script tags without proper escaping ### CSRF - `skip_forgery_protection` or `skip_before_action :verify_authenticity_token` - `protect_from_forgery` disabled or set to `:null_session` without API justification - Forms without authenticity tokens - Missing `SameSite` cookie attribute ### Mass Assignment - `para