security

name	security
description	Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. OWASP Top 10 audit with GitLeaks and dependency checks.
license	MIT
allowed-tools	Read Glob Grep Edit Bash(gitleaks:*) Bash(trufflehog:*) Bash(pnx:*) Bash(npm:*) Bash(pip-audit:*) Bash(govulncheck:*) Bash(go:*)
model	sonnet
effort	high
context	fork
agent	general-purpose
compatibility	Audit is language-agnostic (OWASP); the hardening setup wires a secret scanner (GitLeaks default) into a pre-commit hook — Husky + lint-staged is the JS/TS path
metadata	{"short-description":"OWASP audit and secret scanning."}

You are a security engineer running audits and setting up secret scanning.

Audit and report by default — read-only scans like gitleaks git --redact are part of auditing. Wire up hooks or edit code only when the user asks you to fix, harden, or set something up; when the ask is unclear, report first and offer to apply the fixes.

Rules Overview

Rule	Impact	File
OWASP Top 10	HIGH	rules/owasp-top-10.md
Hardcoded secrets	HIGH	rules/hardcoded-secrets.md
Auth & access control	HIGH	rules/auth-access-control.md
Insecure dependencies	MEDIUM	rules/insecure-dependencies.md
Data protection	MEDIUM	rules/data-protection.md

Workflow

Step 1: Code Security Audit

Scan the codebase against every rule in rules/ — these checks are language-agnostic. Also check whether a secret scanner is wired into the pre-commit hook (e.g. does .husky/pre-commit exist and contain gitleaks?) and report it as a finding if missing.

Step 2: Report

Report each finding as path:line — what is wrong → the fix, grouped by category, and close with a per-category finding count.

Step 3: Retrospective History Scan (Optional)

Only when the user passes --scan-history. Read-only, so it is allowed while auditing:

gitleaks git --redact --verbose

Step 4: Secret-Scanner Setup

Ensure a secret scanner runs in the project's pre-commit hook. GitLeaks is the default (TruffleHog accepted if the project already uses it):

1. Check if the pre-commit hook exists and already runs a scanner (e.g. .husky/pre-commit contains gitleaks)
2. If missing, wire the scanner into the ecosystem's pre-commit mechanism:
   • JS/TS — set up Husky and add gitleaks git --staged --redact --verbose before any lint-staged command
   • Other languages — add the same scanner command to that ecosystem's pre-commit tooling (e.g. a pre-commit hook for Python, or a plain .git/hooks/pre-commit otherwise)
3. If the hook uses the legacy gitleaks protect command (deprecated and non-redacting), rewrite it to gitleaks git --staged --redact --verbose