| name | security-check |
| description | Use when reviewing pending changes, branch diffs, or new features for concrete security risks, injection, auth, permissions, or attack paths. |
| metadata | {"private":true,"clawdbot":{"emoji":"🔴","requires":{"bins":["git"]}}} |
Security Check
Red-team style security review for code changes. Think like an attacker.
Modes
1. Pending Changes (default)
Review uncommitted changes in the current working directory:
git diff HEAD
git diff --cached
2. Branch vs Main
Review all commits on a branch against main:
git log main..<branch> --oneline
git diff main...<branch>
3. Specific Commit Range
git diff <commit1>..<commit2>
Review Checklist
Input Validation
Authentication & Authorization
Secrets & Configuration
Data Exposure
Cryptography
Dependencies
File Operations
Process & Network
Output Format
For each finding:
🔴 [CRITICAL|HIGH|MEDIUM|LOW] <Title>
📍 Location: <file:line>
💀 Attack Vector:
<How an attacker would exploit this>
📝 Code:
<relevant snippet>
✅ Fix:
<suggested remediation>
Workflow
- Identify scope — Ask which mode (pending/branch/commit range)
- Get the diff — Run appropriate git commands
- Analyze systematically — Go through checklist
- Prioritize findings — CRITICAL > HIGH > MEDIUM > LOW
- Suggest fixes — Concrete code changes, not vague advice
- Summary — Executive summary with risk assessment
Quick Commands
git diff HEAD
git diff main...feature-branch
git diff HEAD | grep -iE "(password|secret|api.?key|token|credential)"
git diff HEAD | grep -iE "(eval|exec|system|shell_exec|passthru|popen)"
Risk Levels
- CRITICAL: Exploitable now, high impact (RCE, auth bypass, data breach)
- HIGH: Likely exploitable, significant impact
- MEDIUM: Exploitable under specific conditions
- LOW: Defense-in-depth issues, minor exposure
