/security - Security Audit Workflow
Dedicated security analysis for sensitive code.
When to Use
-
"Security audit"
-
"Check for vulnerabilities"
-
"Is this secure?"
-
"Review authentication code"
-
"Check for injection attacks"
-
Before handling auth, payments, user data
-
After adding security-sensitive features
Workflow Overview
┌─────────┐ ┌───────────┐ │ aegis │───▶│ arbiter │ │ │ │ │ └─────────┘ └───────────┘ Security Verify audit fixes
Agent Sequence
Agent Role Output
1 aegis Comprehensive security scan Vulnerability report
2 arbiter Verify fixes, run security tests Verification report
Why Dedicated Security?
The /review workflow focuses on code quality. Security needs:
-
Specialized vulnerability patterns
-
Dependency scanning
-
Secret detection
-
OWASP Top 10 checks
-
Authentication/authorization review
Execution
Phase 1: Security Audit
Task( subagent_type="aegis", prompt=""" Security audit: [SCOPE]
Scan for:
Injection Attacks:
- SQL injection
- Command injection
- XSS (Cross-Site Scripting)
- LDAP injection
Authentication/Authorization:
- Broken authentication
- Session management issues
- Privilege escalation
- Insecure direct object references
Data Protection:
- Sensitive data exposure
- Hardcoded secrets/credentials
- Insecure cryptography
- Missing encryption
Configuration:
- Security misconfigurations
- Default credentials
- Verbose error messages
- Missing security headers
Dependencies:
- Known vulnerable packages
- Outdated dependencies
- Supply chain risks
Output: Detailed report with:
- Severity (CRITICAL/HIGH/MEDIUM/LOW)
- Location (file:line)
- Description
- Remediation steps """ )
Phase 2: Verification (After Fixes)
Task( subagent_type="arbiter", prompt=""" Verify security fixes: [SCOPE]
Run:
- Security-focused tests
- Dependency audit (npm audit, pip audit)
- Re-check reported vulnerabilities
- Verify fixes don't introduce regressions
Output: Verification report """ )
Security Scopes
Full Codebase
User: /security → Scan entire codebase
Specific Area
User: /security authentication → Focus on auth-related code
Single File
User: /security src/api/auth.py → Deep dive on one file
Dependencies Only
User: /security --deps → Only dependency vulnerabilities
Example
User: /security the payment processing code
Claude: Starting /security audit for payment code...
Phase 1: Security audit... [Spawns aegis]
┌─────────────────────────────────────────────────────────────┐ │ Security Audit Report │ ├─────────────────────────────────────────────────────────────┤ │ Scope: src/services/payment/ │ │ Files scanned: 12 │ │ Lines analyzed: 2,847 │ ├─────────────────────────────────────────────────────────────┤ │ CRITICAL (1) │ │ ────────── │ │ [C1] SQL Injection in payment.py:89 │ │ query = f"SELECT * FROM orders WHERE id = {order_id}" │ │ Fix: Use parameterized queries │ │ │ │ HIGH (2) │ │ ──────── │ │ [H1] Hardcoded API key in stripe_client.py:12 │ │ STRIPE_KEY = "sk_live_..." │ │ Fix: Move to environment variable │ │ │ │ [H2] Missing input validation in refund.py:45 │ │ amount = request.json['amount'] # No validation │ │ Fix: Validate amount is positive number │ │ │ │ MEDIUM (1) │ │ ────────── │ │ [M1] Verbose error messages in error_handler.py:23 │ │ return {"error": str(e)} # Leaks internal details │ │ Fix: Return generic message, log details internally │ │ │ │ LOW (0) │ │ ─────── │ │ None │ ├─────────────────────────────────────────────────────────────┤ │ Summary: 1 critical, 2 high, 1 medium, 0 low │ │ Status: BLOCKING - Fix critical issues before release │ └─────────────────────────────────────────────────────────────┘
Fix the critical and high issues, then run: /security --verify
After Fixes
User: /security --verify
Claude: Phase 2: Verifying fixes... [Spawns arbiter]
✅ C1: SQL injection fixed - using parameterized queries ✅ H1: API key moved to environment variable ✅ H2: Input validation added ✅ M1: Error messages sanitized
All security tests passing. Security audit: PASSED
OWASP Top 10 Coverage
Risk Checked
A01 Broken Access Control ✅
A02 Cryptographic Failures ✅
A03 Injection ✅
A04 Insecure Design ✅
A05 Security Misconfiguration ✅
A06 Vulnerable Components ✅
A07 Auth Failures ✅
A08 Data Integrity Failures ✅
A09 Logging Failures ✅
A10 SSRF ✅
Flags
-
--deps : Dependencies only
-
--verify : Re-run after fixes
-
--owasp : Explicit OWASP Top 10 report
-
--secrets : Focus on secret detection