61e01bfdf1
Consolidates three codebases into a single agent orchestration repo: - agentci (from go-scm): Clotho dual-run verification, agent config, SSH security (sanitisation, secure commands, token masking) - jobrunner (from go-scm): Poll-dispatch-report pipeline with 7 handlers (dispatch, completion, auto-merge, publish draft, dismiss reviews, send fix command, tick parent epic) - plugins marketplace (from agentic/plugins): 27 Claude/Codex/Gemini plugins with shared MCP server All 150+ tests passing across 6 packages. Co-Authored-By: Virgil <virgil@lethean.io>
1.6 KiB
1.6 KiB
| name | description | args | |
|---|---|---|---|
| security | Security-focused code review |
|
Security Review
Perform a security-focused code review.
Focus Areas
1. Injection Vulnerabilities
- SQL injection
- Command injection
- XSS (Cross-Site Scripting)
- LDAP injection
- XML injection
2. Authentication & Authorisation
- Hardcoded credentials
- Weak password handling
- Missing auth checks
- Privilege escalation paths
3. Data Exposure
- Sensitive data in logs
- PII in error messages
- Secrets in version control
- Insecure data transmission
4. Cryptography
- Weak algorithms (MD5, SHA1 for security)
- Hardcoded keys/IVs
- Insecure random number generation
5. Dependencies
- Known vulnerable packages
- Outdated dependencies
Process
- Get diff for specified range
- Scan for security patterns
- Check for common vulnerabilities
- Report findings with severity
Patterns to Check
Go
// SQL injection
db.Query("SELECT * FROM users WHERE id = " + id)
// Command injection
exec.Command("bash", "-c", userInput)
// Hardcoded secrets
apiKey := "sk_live_..."
PHP
// SQL injection
$db->query("SELECT * FROM users WHERE id = $id");
// XSS
echo $request->input('name');
// Command injection
shell_exec($userInput);
Output Format
## Security Review
### Critical
- **file:line** - SQL Injection: User input directly in query
### High
- **file:line** - Hardcoded API key detected
### Medium
- **file:line** - Missing CSRF protection
### Low
- **file:line** - Debug endpoint exposed
---
**Summary**: X critical, Y high, Z medium, W low