Claude Code安全审计子代理实战指南：打造你的代码安全卫士

// 场景对比：处理用户输入

// ❌ 通用Claude可能的处理方式
function handleUserInput(input) {
    // 简单处理，存在多个安全隐患
    const query = `SELECT * FROM users WHERE name = '${input}'`;  // SQL注入！
    const result = database.query(query);
    return`<div>${result.name}</div>`;  // XSS攻击！
}

// ✅ 安全审计子代理会给你的专业方案
/**
 * 安全加固的用户输入处理
 * 遵循OWASP安全最佳实践
 */
class SecureInputHandler {
    constructor() {
        this.validator = new InputValidator();
        this.sanitizer = new OutputSanitizer();
        this.rateLimiter = new RateLimiter();
        this.logger = new SecurityLogger();
    }

    async handleUserInput(input, context) {
        // 1. 速率限制检查
        if (!awaitthis.rateLimiter.check(context.ip)) {
            this.logger.warn('Rate limit exceeded', { ip: context.ip });
            thrownew RateLimitError();
        }

        // 2. 输入验证
        const validation = this.validator.validate(input, {
            type: 'string',
            maxLength: 100,
            pattern: /^[a-zA-Z0-9\s\-_.]+$/,
            blacklist: ['<script>', 'javascript:', 'onclick']
        });

        if (!validation.isValid) {
            this.logger.security('Invalid input detected', {
                input,
                violations: validation.violations,
                context
            });
            thrownew ValidationError(validation.errors);
        }

        // 3. 参数化查询（防SQL注入）
        const query = 'SELECT * FROM users WHERE name = ?';
        const result = await database.query(query, [input]);

        // 4. 输出编码（防XSS）
        const encodedName = this.sanitizer.encodeHTML(result.name);
        
        // 5. 内容安全策略
        const csp = {
            'Content-Security-Policy': "default-src 'self'; script-src 'self'"
        };

        // 6. 审计日志
        this.logger.audit('User input processed', {
            userId: context.userId,
            action: 'search',
            timestamp: newDate()
        });

        return {
            data: `<div data-user="${encodedName}">${encodedName}</div>`,
            headers: csp
        };
    }
}

---
name: code-security-auditor
description: Comprehensive security analysis and vulnerability detection for codebases. Specializes in threat modeling, secure coding practices, and compliance auditing. Use PROACTIVELY for security reviews and penetration testing preparation.
model: sonnet
---
You are a cybersecurity expert specializing in code security auditing, vulnerability assessment, and secure development practices.

## Security Audit Expertise
- Static Application Security Testing (SAST) methodologies
- Dynamic Application Security Testing (DAST) implementation
- Dependency vulnerability scanning and management
- Threat modeling and attack surface analysis
- OWASP Top 10 vulnerability identification and remediation
- Secure coding pattern implementation
- Authentication and authorization security review
- Cryptographic implementation audit and best practices

## Security Assessment Framework
1. Automated vulnerability scanning with multiple tools
2. Manual code review for logic flaws and business logic vulnerabilities
3. Dependency analysis for known CVEs and license compliance
4. Configuration security assessment (servers, databases, APIs)
5. Input validation and output encoding verification
6. Session management and authentication mechanism review
7. Data protection and privacy compliance checking
8. Infrastructure security configuration validation

## Common Vulnerability Categories
- Injection attacks (SQL, NoSQL, LDAP, Command injection)
- Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF)
- Broken authentication and session management
- Insecure direct object references and path traversal
- Security misconfiguration and default credentials
- Sensitive data exposure and insufficient cryptography
- XML External Entity (XXE) processing vulnerabilities
- Server-Side Request Forgery (SSRF) exploitation
- Deserialization vulnerabilities and buffer overflows

## Security Implementation Standards
- Principle of least privilege enforcement
- Defense in depth strategy implementation
- Secure by design architecture review
- Zero trust security model integration
- Compliance framework adherence (SOC 2, PCI DSS, GDPR)
- Security logging and monitoring implementation
- Incident response procedure integration
- Security training and awareness documentation
- Penetration testing preparation and remediation planning

Execute thorough security assessments with actionable remediation guidance. Prioritize critical vulnerabilities while building sustainable security practices into the development lifecycle.

---
name: code-security-auditor
description: 代码库的全面安全分析和漏洞检测。专精威胁建模、安全编码实践和合规审计。在安全审查和渗透测试准备时主动使用。
model: sonnet
---
你是一位网络安全专家，专精代码安全审计、漏洞评估和安全开发实践。

## 安全审计专业技能 / Security Audit Expertise
- 静态应用安全测试(SAST)方法论
- 动态应用安全测试(DAST)实施
- 依赖漏洞扫描和管理
- 威胁建模和攻击面分析
- OWASP Top 10漏洞识别和修复
- 安全编码模式实施
- 认证和授权安全审查
- 加密实现审计和最佳实践

## 安全评估框架 / Security Assessment Framework
1. 使用多种工具的自动漏洞扫描
2. 逻辑缺陷和业务逻辑漏洞的手动代码审查
3. 已知CVE和许可证合规的依赖分析
4. 配置安全评估（服务器、数据库、API）
5. 输入验证和输出编码验证
6. 会话管理和认证机制审查
7. 数据保护和隐私合规检查
8. 基础设施安全配置验证

## 常见漏洞类别 / Common Vulnerability Categories
- 注入攻击（SQL、NoSQL、LDAP、命令注入）
- 跨站脚本(XSS)和跨站请求伪造(CSRF)
- 认证破坏和会话管理问题
- 不安全的直接对象引用和路径遍历
- 安全配置错误和默认凭据
- 敏感数据暴露和加密不足
- XML外部实体(XXE)处理漏洞
- 服务器端请求伪造(SSRF)利用
- 反序列化漏洞和缓冲区溢出

## 安全实施标准 / Security Implementation Standards
- 最小权限原则执行
- 纵深防御策略实施
- 安全设计架构审查
- 零信任安全模型集成
- 合规框架遵守（SOC 2、PCI DSS、GDPR）
- 安全日志和监控实施
- 事件响应程序集成
- 安全培训和意识文档
- 渗透测试准备和修复规划

执行全面的安全评估，提供可操作的修复指导。
优先处理关键漏洞，同时将可持续的安全实践构建到开发生命周期中。

// 1. 什么是SQL注入？
// 就像有人在表单里填写恶意代码，欺骗数据库
const userInput = "'; DROP TABLE users; --";
// 错误做法：直接拼接
const query = `SELECT * FROM users WHERE name = '${userInput}'`;
// 正确做法：参数化查询
const query = 'SELECT * FROM users WHERE name = ?';

// 2. 什么是XSS攻击？
// 就像在网页里注入恶意脚本
const comment = "<script>alert('Hacked!')</script>";
// 错误：直接输出
document.innerHTML = comment;  // 执行恶意脚本！
// 正确：编码输出
document.textContent = comment;  // 只显示文本

// 3. 什么是CSRF？
// 就像伪造你的签名进行操作
// 防护：使用CSRF Token
const csrfToken = generateToken();
// 每个表单都要验证token

// 4. 什么是加密？
// 就像把信息装进保险箱
const encrypted = encrypt(sensitiveData, secretKey);
const decrypted = decrypt(encrypted, secretKey);

# 在Claude Code中输入
/agents

对这个Web应用进行全面的安全审计

// ========== 安全审计报告 ==========
// 项目：Web Application Security Audit
// 日期：2024-03-20
// 严重等级：Critical(3) High(5) Medium(8) Low(12)

// 第一部分：关键漏洞和修复方案

// 🔴 Critical-1: SQL注入漏洞
// 位置：/api/user/search
const vulnerableCode = {
    location: 'userController.js:45',
    code: `
        // 漏洞代码
        const query = "SELECT * FROM users WHERE email = '" + req.body.email + "'";
        db.query(query);
    `,
    risk: 'SQL注入可导致数据库完全泄露或破坏',
    fix: `
        // 修复方案：使用参数化查询
        const query = 'SELECT * FROM users WHERE email = ?';
        db.query(query, [req.body.email]);
    `
};

// 🔴 Critical-2: 硬编码的密钥
const hardcodedSecrets = {
    location: 'config.js:12',
    code: `
        // 漏洞代码
        const JWT_SECRET = 'my-secret-key-123';
        const API_KEY = 'sk_live_abcd1234';
    `,
    risk: '密钥泄露导致系统完全被控制',
    fix: `
        // 修复方案：使用环境变量
        const JWT_SECRET = process.env.JWT_SECRET;
        const API_KEY = process.env.API_KEY;
        
        // .env文件（不要提交到版本控制）
        JWT_SECRET=your-secure-random-key
        API_KEY=your-api-key
    `
};

// 第二部分：安全加固实施方案

class SecurityHardening {
    // 1. 输入验证和清理
    implementInputValidation() {
        const validator = {
            email: (input) => {
                const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
                if (!emailRegex.test(input)) {
                    thrownew ValidationError('Invalid email format');
                }
                return input.toLowerCase().trim();
            },
            
            username: (input) => {
                const usernameRegex = /^[a-zA-Z0-9_-]{3,20}$/;
                if (!usernameRegex.test(input)) {
                    thrownew ValidationError('Username must be 3-20 characters');
                }
                return input;
            },
            
            sanitizeHTML: (input) => {
                const DOMPurify = require('isomorphic-dompurify');
                return DOMPurify.sanitize(input, {
                    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
                    ALLOWED_ATTR: ['href']
                });
            }
        };
        
        return validator;
    }
    
    // 2. 认证和授权加固
    implementSecureAuth() {
        const authConfig = {
            // JWT配置
            jwt: {
                algorithm: 'RS256',  // 使用非对称加密
                expiresIn: '15m',     // 短期访问令牌
                refreshExpiresIn: '7d',
                issuer: 'your-app',
                audience: 'your-api'
            },
            
            // 密码策略
            password: {
                minLength: 12,
                requireUppercase: true,
                requireLowercase: true,
                requireNumbers: true,
                requireSymbols: true,
                preventCommon: true,  // 检查常见密码
                preventReuse: 5       // 防止重复使用最近5个密码
            },
            
            // 多因素认证
            mfa: {
                required: true,
                methods: ['totp', 'sms', 'email'],
                backupCodes: 10
            }
        };
        
        return authConfig;
    }
    
    // 3. 安全头部配置
    implementSecurityHeaders() {
        return {
            'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
            'X-Content-Type-Options': 'nosniff',
            'X-Frame-Options': 'DENY',
            'X-XSS-Protection': '1; mode=block',
            'Content-Security-Policy': `
                default-src 'self';
                script-src 'self' 'unsafe-inline';
                style-src 'self' 'unsafe-inline';
                img-src 'self' data: https:;
                font-src 'self';
                connect-src 'self';
                frame-ancestors 'none';
            `.replace(/\s+/g, ' ').trim(),
            'Referrer-Policy': 'strict-origin-when-cross-origin',
            'Permissions-Policy': 'geolocation=(), microphone=(), camera=()'
        };
    }
    
    // 4. 数据加密
    implementEncryption() {
        const crypto = require('crypto');
        
        return {
            // 对称加密（AES-256-GCM）
            encrypt: (text, password) => {
                const salt = crypto.randomBytes(32);
                const key = crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256');
                const iv = crypto.randomBytes(16);
                const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
                
                let encrypted = cipher.update(text, 'utf8', 'hex');
                encrypted += cipher.final('hex');
                const authTag = cipher.getAuthTag();
                
                return {
                    encrypted,
                    salt: salt.toString('hex'),
                    iv: iv.toString('hex'),
                    authTag: authTag.toString('hex')
                };
            },
            
            // 哈希敏感数据
            hash: (data) => {
                return crypto.createHash('sha256').update(data).digest('hex');
            },
            
            // 安全随机令牌
            generateToken: () => {
                return crypto.randomBytes(32).toString('hex');
            }
        };
    }
}

// 第三部分：依赖漏洞扫描

const dependencyAudit = {
    vulnerabilities: [
        {
            package: 'lodash',
            version: '4.17.11',
            vulnerability: 'Prototype Pollution',
            severity: 'High',
            fix: 'Update to 4.17.21'
        },
        {
            package: 'axios',
            version: '0.19.0',
            vulnerability: 'SSRF',
            severity: 'Medium',
            fix: 'Update to 0.21.2 or later'
        }
    ],
    
    commands: `
        # NPM审计
        npm audit
        npm audit fix
        
        # 使用Snyk扫描
        npx snyk test
        
        # OWASP依赖检查
        dependency-check --project "MyApp" --scan ./
    `
};

// 第四部分：安全测试脚本

const securityTests = `
// security.test.js
describe('Security Tests', () => {
    // SQL注入测试
    it('should prevent SQL injection', async () => {
        const maliciousInput = "'; DROP TABLE users; --";
        const response = await request(app)
            .post('/api/search')
            .send({ query: maliciousInput });
        
        expect(response.status).toBe(400);
        expect(response.body.error).toContain('Invalid input');
    });
    
    // XSS测试
    it('should prevent XSS attacks', async () => {
        const xssPayload = '<script>alert("XSS")</script>';
        const response = await request(app)
            .post('/api/comment')
            .send({ content: xssPayload });
        
        expect(response.body.content).not.toContain('<script>');
    });
    
    // 认证测试
    it('should enforce authentication', async () => {
        const response = await request(app)
            .get('/api/protected');
        
        expect(response.status).toBe(401);
    });
});
`;

// 第五部分：合规检查清单

const complianceChecklist = {
    GDPR: {
        dataProtection: '✅ 数据加密存储',
        userConsent: '⚠️ 需要改进同意机制',
        dataPortability: '✅ 支持数据导出',
        rightToErasure: '✅ 支持账户删除'
    },
    
    PCI_DSS: {
        encryption: '✅ 信用卡数据加密',
        accessControl: '✅ 基于角色的访问控制',
        logging: '⚠️ 需要增强审计日志',
        testing: '❌ 需要定期安全测试'
    },
    
    OWASP: {
        injection: '✅ 已修复',
        brokenAuth: '⚠️ 需要MFA',
        sensitiveData: '✅ 已加密',
        xxe: '✅ 已禁用',
        brokenAccess: '✅ 已实施',
        securityMisconfig: '⚠️ 需要检查',
        xss: '✅ 已防护',
        deserialization: '✅ 安全',
        components: '⚠️ 需要更新',
        logging: '⚠️ 需要改进'
    }
};

帮我设计一个实时安全监控系统

// 实时安全监控系统设计

class SecurityMonitoringSystem {
    constructor() {
        this.alertThresholds = this.defineThresholds();
        this.monitors = this.initializeMonitors();
    }
    
    // 1. 定义监控指标和阈值
    defineThresholds() {
        return {
            failedLogins: { max: 5, window: '5m', action: 'block' },
            requestRate: { max: 100, window: '1m', action: 'throttle' },
            errorRate: { max: 0.05, window: '5m', action: 'alert' },
            responseTime: { max: 2000, window: '1m', action: 'scale' }
        };
    }
    
    // 2. 安全事件检测
    async detectSecurityEvents(event) {
        const detectors = {
            // 暴力破解检测
            bruteForce: (e) => {
                const attempts = this.getRecentAttempts(e.ip);
                return attempts > 10;
            },
            
            // 异常行为检测
            anomaly: (e) => {
                const baseline = this.getUserBaseline(e.userId);
                returnthis.calculateDeviation(e, baseline) > 3;
            },
            
            // 数据泄露检测
            dataLeak: (e) => {
                return e.responseSize > 10 * 1024 * 1024;  // 10MB
            }
        };
        
        for (const [type, detector] ofObject.entries(detectors)) {
            if (detector(event)) {
                awaitthis.handleSecurityIncident(type, event);
            }
        }
    }
    
    // 3. 事件响应
    async handleSecurityIncident(type, event) {
        const response = {
            bruteForce: async () => {
                awaitthis.blockIP(event.ip);
                awaitthis.notifySecurityTeam('Brute force attack detected');
            },
            
            anomaly: async () => {
                awaitthis.requireMFA(event.userId);
                awaitthis.logAnomaly(event);
            },
            
            dataLeak: async () => {
                awaitthis.terminateSession(event.sessionId);
                awaitthis.investigateDataAccess(event);
            }
        };
        
        await response[type]();
    }
}

## Security Audit Expertise
- Express安全中间件配置
- JWT安全实践
- npm依赖审计
- Node.js特定漏洞

## Security Audit Expertise  
- Kubernetes安全配置
- Docker镜像扫描
- 服务网格安全
- Secrets管理

## Team Standards
- 安全基线：OWASP Top 10全覆盖
- 扫描频率：每次提交自动扫描
- 修复时限：Critical 24小时，High 3天
- 审计报告：每月生成合规报告