Antigravity × AI-Driven Security Audit Automation— Building an Agent Pipeline That Detects and Fixes Vulnerabilities

# Security Audit Manager
 
You are the security audit orchestrator.
Manage the three specialized agents below and produce a comprehensive security report.
 
## Delegation Rules
1. Delegate dependency vulnerability checks to `dependency-scanner`
2. Delegate source code security reviews to `code-reviewer`
3. Delegate infrastructure and environment audits to `infra-checker`
4. Aggregate all results into a severity-sorted report
 
---
 
# dependency-scanner
 
You are a dependency security specialist.
- Analyze package.json and package-lock.json
- Cross-reference against known CVE databases
- Check if patched versions are available
- Classify severity as Critical / High / Medium / Low
 
---
 
# code-reviewer
 
You are an application security specialist.
Review source code against the OWASP Top 10:
- SQL Injection
- Cross-Site Scripting (XSS)
- Broken Authentication & Authorization
- Hardcoded Secrets
- Insecure Deserialization
 
---
 
# infra-checker
 
You are an infrastructure security specialist.
- Verify environment variable management
- Validate CORS configuration
- Confirm HTTPS enforcement
- Audit security headers (CSP, HSTS, etc.)

// scripts/security-audit.ts
// Automated security audit execution script
 
import { execSync } from "child_process";
import * as fs from "fs";
 
interface AuditVulnerability {
  name: string;
  severity: "critical" | "high" | "moderate" | "low";
  title: string;
  url: string;
  fixAvailable: boolean;
}
 
function runDependencyAudit(): AuditVulnerability[] {
  try {
    // Run npm audit in JSON format
    const result = execSync("npm audit --json", {
      encoding: "utf-8",
      timeout: 30000,
    });
    const audit = JSON.parse(result);
 
    return Object.entries(audit.vulnerabilities || {}).map(
      ([name, data]: [string, any]) => ({
        name,
        severity: data.severity,
        title: data.title || "Unknown vulnerability",
        url: data.url || "",
        fixAvailable: !!data.fixAvailable,
      })
    );
  } catch (error: any) {
    // npm audit exits with code 1 when vulnerabilities are found
    if (error.stdout) {
      const audit = JSON.parse(error.stdout);
      return Object.entries(audit.vulnerabilities || {}).map(
        ([name, data]: [string, any]) => ({
          name,
          severity: data.severity,
          title: data.title || "Unknown vulnerability",
          url: data.url || "",
          fixAvailable: !!data.fixAvailable,
        })
      );
    }
    throw error;
  }
}
 
// Execute and output results
const vulnerabilities = runDependencyAudit();
const critical = vulnerabilities.filter((v) => v.severity === "critical");
const high = vulnerabilities.filter((v) => v.severity === "high");
 
console.log(`\n🔍 Dependency Security Report`);
console.log(`${"=".repeat(50)}`);
console.log(`Critical: ${critical.length}`);
console.log(`High: ${high.length}`);
console.log(`Total: ${vulnerabilities.length}`);
 
// Expected output:
// 🔍 Dependency Security Report
// ==================================================
// Critical: 0
// High: 2
// Total: 8

## Dependency Vulnerability Report
 
| Package   | Severity | CVE            | Fixed In | Action              |
|-----------|----------|----------------|----------|---------------------|
| lodash    | High     | CVE-2024-XXXX  | 4.17.22  | `npm update lodash` |
| express   | Medium   | CVE-2024-YYYY  | 4.19.3   | `npm update express`|

// lib/security-patterns.ts
// Security pattern detection library
 
export const SQL_INJECTION_PATTERNS = [
  // String concatenation in queries (dangerous)
  /`SELECT.*\$\{.*\}`/g,
  /['"]SELECT.*['"] \+ /g,
  /query\(.*\+.*\)/g,
 
  // Direct template literal interpolation (dangerous)
  /\.query\(`[^`]*\$\{[^}]+\}[^`]*`\)/g,
 
  // eval or Function constructor (extremely dangerous)
  /eval\s*\(/g,
  /new\s+Function\s*\(/g,
] as const;
 
export const XSS_PATTERNS = [
  // Unsanitized input to innerHTML
  /\.innerHTML\s*=\s*(?!['"`])/g,
  // dangerouslySetInnerHTML (React)
  /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html:\s*(?!DOMPurify)/g,
  // document.write
  /document\.write\s*\(/g,
] as const;
 
export const AUTH_PATTERNS = [
  // Hardcoded secrets
  /(?:password|secret|api[_-]?key|token)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
  // Skipping JWT verification
  /verify\s*:\s*false/g,
  // Insecure random generation
  /Math\.random\(\)/g,
] as const;
 
/**
 * Scan a file for security issues
 */
export function scanFile(
  content: string,
  filePath: string
): SecurityIssue[] {
  const issues: SecurityIssue[] = [];
 
  // SQL Injection checks
  SQL_INJECTION_PATTERNS.forEach((pattern) => {
    const matches = content.matchAll(new RegExp(pattern));
    for (const match of matches) {
      issues.push({
        type: "SQL_INJECTION",
        severity: "critical",
        file: filePath,
        line: getLineNumber(content, match.index!),
        message: "Unsanitized input directly interpolated in SQL query",
        recommendation:
          "Use parameterized queries or an ORM instead",
      });
    }
  });
 
  // XSS checks
  XSS_PATTERNS.forEach((pattern) => {
    const matches = content.matchAll(new RegExp(pattern));
    for (const match of matches) {
      issues.push({
        type: "XSS",
        severity: "high",
        file: filePath,
        line: getLineNumber(content, match.index!),
        message: "Unsanitized input may be injected into the DOM",
        recommendation: "Use DOMPurify or text nodes instead",
      });
    }
  });
 
  return issues;
}
 
interface SecurityIssue {
  type: string;
  severity: "critical" | "high" | "medium" | "low";
  file: string;
  line: number;
  message: string;
  recommendation: string;
}
 
function getLineNumber(content: string, index: number): number {
  return content.substring(0, index).split("\n").length;
}
 
// Expected output (when running scanFile):
// [
//   {
//     type: "SQL_INJECTION",
//     severity: "critical",
//     file: "src/api/users.ts",
//     line: 42,
//     message: "Unsanitized input directly interpolated in SQL query",
//     recommendation: "Use parameterized queries or an ORM instead"
//   }
// ]

// scripts/check-security-headers.ts
// Validates security headers for a web application
 
interface SecurityHeaderCheck {
  header: string;
  expected: string | RegExp;
  severity: "critical" | "high" | "medium";
  description: string;
}
 
const REQUIRED_HEADERS: SecurityHeaderCheck[] = [
  {
    header: "Strict-Transport-Security",
    expected: /max-age=\d{8,}/,
    severity: "critical",
    description: "HSTS: Enforce HTTPS (max-age of at least 1 year recommended)",
  },
  {
    header: "Content-Security-Policy",
    expected: /default-src/,
    severity: "high",
    description: "CSP: Defend against XSS and data injection attacks",
  },
  {
    header: "X-Content-Type-Options",
    expected: "nosniff",
    severity: "medium",
    description: "Prevent MIME-type sniffing",
  },
  {
    header: "X-Frame-Options",
    expected: /DENY|SAMEORIGIN/,
    severity: "medium",
    description: "Prevent clickjacking attacks",
  },
  {
    header: "Referrer-Policy",
    expected: /strict-origin|no-referrer/,
    severity: "medium",
    description: "Prevent referrer information leakage",
  },
];
 
async function checkSecurityHeaders(url: string) {
  const response = await fetch(url, { method: "HEAD" });
 
  console.log(`\n🛡️ Security Headers Audit: ${url}`);
  console.log("=".repeat(60));
 
  let issues = 0;
 
  for (const check of REQUIRED_HEADERS) {
    const value = response.headers.get(check.header);
    const passed = value
      ? typeof check.expected === "string"
        ? value === check.expected
        : check.expected.test(value)
      : false;
 
    const status = passed ? "✅" : "❌";
    console.log(`${status} ${check.header}`);
 
    if (!passed) {
      console.log(`   Severity: ${check.severity}`);
      console.log(`   ${check.description}`);
      console.log(`   Current value: ${value || "(not set)"}`);
      issues++;
    }
  }
 
  console.log(`\nTotal: ${issues} issue(s) found`);
  return issues;
}
 
// Usage
// checkSecurityHeaders("https://your-app.example.com");
 
// Expected output:
// 🛡️ Security Headers Audit: https://your-app.example.com
// ============================================================
// ✅ Strict-Transport-Security
// ❌ Content-Security-Policy
//    Severity: high
//    CSP: Defend against XSS and data injection attacks
//    Current value: (not set)
// ✅ X-Content-Type-Options
// ✅ X-Frame-Options
// ✅ Referrer-Policy
//
// Total: 1 issue(s) found

// scripts/check-env-security.ts
// Audits environment variable management and secret handling
 
import * as fs from "fs";
import * as path from "path";
 
const SENSITIVE_PATTERNS = [
  /API[_-]?KEY/i,
  /SECRET/i,
  /PASSWORD/i,
  /TOKEN/i,
  /PRIVATE[_-]?KEY/i,
  /DATABASE[_-]?URL/i,
  /STRIPE[_-]?SECRET/i,
];
 
function auditEnvSecurity(projectRoot: string): void {
  const issues: string[] = [];
 
  // Check if .env is in .gitignore
  const gitignorePath = path.join(projectRoot, ".gitignore");
  if (fs.existsSync(gitignorePath)) {
    const gitignore = fs.readFileSync(gitignorePath, "utf-8");
    if (!gitignore.includes(".env")) {
      issues.push(
        "⚠️ CRITICAL: .env is not listed in .gitignore"
      );
    }
  }
 
  // Scan source code for hardcoded secrets
  const srcDir = path.join(projectRoot, "src");
  if (fs.existsSync(srcDir)) {
    scanDirectory(srcDir, issues);
  }
 
  console.log("\n🔐 Environment Variable Security Audit");
  console.log("=".repeat(50));
 
  if (issues.length === 0) {
    console.log("✅ No issues detected");
  } else {
    issues.forEach((issue) => console.log(issue));
  }
}
 
function scanDirectory(dir: string, issues: string[]): void {
  const files = fs.readdirSync(dir, { withFileTypes: true });
 
  for (const file of files) {
    const fullPath = path.join(dir, file.name);
 
    if (file.isDirectory() && file.name !== "node_modules") {
      scanDirectory(fullPath, issues);
    } else if (
      file.isFile() &&
      /\.(ts|js|tsx|jsx)$/.test(file.name)
    ) {
      const content = fs.readFileSync(fullPath, "utf-8");
      const lines = content.split("\n");
 
      lines.forEach((line, index) => {
        SENSITIVE_PATTERNS.forEach((pattern) => {
          if (
            pattern.test(line) &&
            /['"][^'"]{8,}['"]/.test(line)
          ) {
            issues.push(
              `⚠️ HIGH: ${fullPath}:${index + 1} — ` +
                `Possible hardcoded secret detected`
            );
          }
        });
      });
    }
  }
}
 
// Run the audit
// auditEnvSecurity(process.cwd());
 
// Expected output:
// 🔐 Environment Variable Security Audit
// ==================================================
// ⚠️ HIGH: src/config/database.ts:15 — Possible hardcoded secret detected
// ⚠️ CRITICAL: .env is not listed in .gitignore

# .github/workflows/security-audit.yml
name: Security Audit
 
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  schedule:
    # Run weekly on Mondays at 9:00 JST
    - cron: "0 0 * * 1"
 
jobs:
  dependency-scan:
    name: Dependency Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
 
      - run: npm ci
 
      - name: Run npm audit
        run: |
          npm audit --audit-level=high || true
          npm audit --json > audit-report.json
 
      - name: Upload audit report
        uses: actions/upload-artifact@v4
        with:
          name: audit-report
          path: audit-report.json
 
  code-security-review:
    name: Code Security Review
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
 
      - run: npm ci
 
      - name: Run security pattern scan
        run: npx ts-node scripts/security-audit.ts
 
      - name: Check for hardcoded secrets
        run: |
          # Detect hardcoded sensitive values
          if grep -rn \
            -e "API_KEY\s*=\s*['\"][^'\"]*['\"]" \
            -e "SECRET\s*=\s*['\"][^'\"]*['\"]" \
            --include="*.ts" --include="*.js" \
            --exclude-dir=node_modules \
            src/; then
            echo "::error::Hardcoded secrets detected!"
            exit 1
          fi
 
  security-headers:
    name: Security Headers Check
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    steps:
      - uses: actions/checkout@v4
 
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
 
      - run: npm ci
 
      - name: Check production security headers
        run: npx ts-node scripts/check-security-headers.ts
        env:
          TARGET_URL: ${{ secrets.PRODUCTION_URL }}