security-auditor

Automatic security vulnerability detection. 1. SQL Injection 2. XSS (Cross-Site Scripting) 3. Authentication Issues 4. Sensitive Data Exposure 5. Broken Access Control I can run security audits on dependencies: Me (Skill): Quick vulnerability pattern detection @code-reviewer (Sub-Agent): Deep security audit with threat modeling Works without sandboxing: ✅ Yes Works with sandboxing: ✅ Yes Optional: For dependency scanning Add company-specific security patterns: - ✅ Code files modified (especially auth, API, database) - ✅ User mentions security or vulnerabilities - ✅ Before deployments or commits - ✅ Dependency changes - ✅ Configuration file changes - Insecure Deserialization - Security Misconfiguration - Insufficient Logging - CSRF Protection Missing - CORS Misconfiguration - 🚨 CRITICAL : Must fix immediately (exploitable vulnerabilities) - ⚠️ HIGH : Should fix soon (security weaknesses) - 📋 MEDIUM : Consider fixing (potential issues) - 💡 LOW : Best practice improvements - I detect vulnerability pattern - I flag: "🚨 SQL injection detected" - You want full analysis → Invoke @code-reviewer sub-agent - Sub-agent provides comprehensive security audit - Weak password policies - Missing MFA - Session fixation - Insecure password storage - Missing access control - Privilege escalation - IDOR (Insecure Direct Object Reference) - Unencrypted sensitive data - Weak encryption...