security

name	security
description	Audit project security posture. Review for OWASP Top 10 vulnerabilities, secrets, injection flaws, and auth gaps. Use --setup to configure security strategy.
argument-hint	[feature-name] | --setup | --audit | --diff | --fix
context	fork

Strategy check

Before routing, check if spec/SECURITY_STRATEGY.md exists:

• If NOT exists AND mode is a feature name (not --setup, --audit, --diff, or --fix): → Output: "No SECURITY_STRATEGY.md found. Run /security --setup to configure your security strategy, or /security --audit for a project-wide audit." → STOP
• --setup, --audit, --diff, and --fix modes proceed without strategy file.

Routing

Parse $ARGUMENTS to determine mode:

• --setup: Spawn security-reviewer agent (sonnet) with:

  Set up the security strategy for this project.
  Ask the user about their security preferences:
  1. Compliance requirements (GDPR, HIPAA, PCI DSS, SOC2, or none)
  2. Sensitive file patterns (auth, payment, encryption paths — offer sensible defaults)
  3. Dependency policy (block critical vulns, auto-update, manual review)
  4. Secret management approach (env vars, vault, cloud secrets manager)
  5. Custom security rules (project-specific patterns to flag)
  6. Severity threshold for reporting (critical, high, medium, low)
  Write the result to spec/SECURITY_STRATEGY.md.
  

• --audit: Spawn security-reviewer agent (sonnet) with:

  Run a project-wide security audit.
  Scan all source files and dependencies.
  Write report to spec/SECURITY_REPORT.md.
  Do not modify any code.
  

• --diff: Spawn security-reviewer agent (sonnet) with:

  Run a security audit on changed files only (git diff).
  Report findings for modified files.
  Do not modify any code.
  

• --fix: Spawn security-reviewer agent (sonnet) with:

  Run a full security audit, then propose fixes for each finding.
  Present all findings and proposed remediation to the user.
  Apply fixes only after user confirmation for each change.
  

• Feature mode (default — when $ARGUMENTS is a feature name): Spawn security-reviewer agent (sonnet) with:

  Run security audit for feature: [feature-name from $ARGUMENTS]
  Read spec/SECURITY_STRATEGY.md for rules.
  Check all files related to this feature.
  Write report to spec/SECURITY_REPORT.md.
  Do not modify any code.