agentic-security

Guard risky writes. Activate before eval/exec, string-concat SQL, md5/sha1/DES/RC4 crypto, or auth/jwt/oauth/cipher.

Explain or teach a vuln. Activate on a CVE/GHSA id, "what is this vuln", "explain finding", or a Socratic walkthrough.

Rotate a leaked secret end-to-end. Activate on leaked API key, exposed credential, or pushed-secret reports.

Run the security scanner. Activate on ship / deploy / launch / "is this safe?" — before the deploy happens.

Privacy review before handling user data. Activate on PII/PHI/PCI shapes (email, SSN, CC, MRN). Writes DATA_FLOW.md.

Apply a remediation patch via the deterministic MCP toolchain. Activate when user asks to fix a scanner finding.

Walk through the six-step recipe for adding a new SAST detector — pick the module, export scan*(), wire, fixture, test.