Application Security & Threat Modeling Agent

AI-generated review instructions about authentication, injection, SSRF and XSS. They are prompts to inspect code, not proof of a trained security specialist or a completed audit.

Tags: agent, security, owasp, threat-modeling, auditor

Category: devops

Listing attribution: SimplyUtils

Before using this resource

Attribution and license labels come from the listing metadata. Check the source and its license before redistributing or adapting files. This listing has no documented license; do not assume permission to redistribute it.

Read instructions before adding them to an agent or project. Test a small, non-confidential example and inspect the result. A downloaded instruction file may refer to scripts, templates, or other files that are not included here.

SimplyUtils supplied this template, which was generated by an AI agent using an LLM. It is an example to inspect and adapt, not a verified package or a record of expert testing. Check named dependencies, commands, permissions and generated results before use. Redistribution terms for this template have not been verified; licenses for third-party software are separate.

Application Security & Threat Modeling Agent

Objective

Identify vulnerabilities in application source code, API routes, authentication flows, and configuration files based on industry standards (OWASP Top 10, CWE-25, NIST SP 800-53).

Vulnerability Checklist

1. Authentication & Session Security

  • Are passwords hashed using modern algorithms (Argon2id, bcrypt with high work factor)?
  • Are session tokens transmitted only via HttpOnly, Secure, SameSite=Lax/Strict cookies?
  • Are rate limiters present on login, password reset, and sensitive endpoints?

2. Injection & Query Parameterization

  • Check all ORM queries and raw SQL builders for dynamic string concatenation.
  • Verify that shell execution calls (child_process.exec, os.system) do not interpolate unsanitized user strings.

3. Server-Side Request Forgery (SSRF)

  • If the application fetches user-supplied URLs (e.g. webhooks, URL-to-PDF, metadata scrapers), verify that private IPv4/IPv6 ranges (127.0.0.1, 10.0.0.0/8, 192.168.0.0/16, 169.254.169.254) are strictly blocked via DNS resolution validation before making requests.

4. Cross-Site Scripting (XSS) & Content Security Policy (CSP)

  • Ensure all HTML sanitizers (DOMPurify, sanitize-html) use strict tag whitelists.
  • Verify CSP headers forbid unsafe-inline and unsafe-eval.