| name | security |
| description | OWASP audit, threat modeling, CVE/dependency scanning. Supports --quick (default, ~10 min) and --deep (Ralph Wiggum: exhaustive OWASP x SAST rules x iterative attack chain, ~45-90 min). SAST runs on Opengrep + in-house bpm-rulepacks (never license-restricted registry rules). Proactive: before production deploys, after auth changes, new user-input handling, or adding dependencies. NOT for code quality — use /review-code. |
Security Audit
Load and follow the instructions in the security-auditor agent.
Performs a professional security assessment following OWASP, NIST, and industry-standard frameworks.
Depth flags
| Flag | Scope | Time |
|---|
/security / /security --quick | Phases 1-3: understand, automated scan, one-pass OWASP | ~10 min |
/security --deep | Full Ralph Wiggum loop (see agents/shared/RALPH_WIGGUM_LOOP.md): every OWASP category iterated to confidence >= 7, every custom SAST rule file walked (Opengrep + bpm-rulepacks), iterative attack-chain until stable. Blocks until ~/.config/opencode/scripts/validators/run-coverage-loop.sh security-deep exits clean (the wrapper, not the bare gate — it counts iterations in docs/work/COVERAGE_LOOP_security-deep_<date>.md, caps at 3, and halts immediately on exit 3 when a round changes nothing). This file used to name validate-phase-gate.sh here while calling itself a Ralph Wiggum loop: same validators, no counter, so an OWASP category that would not converge iterated until a human noticed. | ~45-90 min |
Fix mode
/security --fix — audit, then drive a verified fix loop: build a fix backlog (CRITICAL+HIGH by default), dispatch coding-agent to remediate, and re-scan to confirm each finding is actually closed before marking it fixed (per agents/shared/FIX_VERIFY_LOOP.md). Findings in dead/unreachable code are skipped (not exploitable). Combine with --deep for an exhaustive find-and-fix pass: /security --deep --fix. Anything whose fix changes auth/crypto/input behavior is flagged for human review, not silently applied.
Focused modes
/security --threat-model — STRIDE threat analysis/security --owasp — OWASP vulnerability scan only (skip threat model / deps)/security --deps — Dependency vulnerability audit only
Combine flags: /security --deep --owasp runs deep mode on OWASP surface only.
Workflow
Understand → Research → Plan → Execute → Verify → Report
In --deep mode, the Plan-Execute-Verify loop iterates per Ralph Wiggum until every row of the inventory (OWASP category, SAST rule file, attack-chain pattern) is covered.
Output
docs/security/OWASP_TRACKER.md — per-category confidence trackerdocs/security/attack-chains.md — multi-step exploit chainsdocs/security/final-report.md — findings with severity, file:line, evidence, remediation
When to pick deep
- Before a production deploy to a security-sensitive environment
- Before a compliance audit (SOC2, PCI, HIPAA)
- After adding auth, session, authorization, user-input, file-upload, SQL, crypto, or external-API-with-credentials surfaces
- When a CVE drops on a dependency you use and you want to confirm reachability + no chains
Reference documents available in references/: owasp-checklist.md, severity-matrix.md, report-template.md.
