| name | audit |
| description | Use when the user wants a security review of code or a diff — OWASP/CWE findings with severity, taint/data-flow analysis, and concrete fixes via security_review |
| user-invocable | true |
/audit — Security Review
Run a dedicated security audit with the security_review tool — it carries an attacker mental model (taint/data-flow, OWASP/CWE), not a generic code review.
Steps
- Scope the review: a diff (paste it, or
git diff) to check changed code only, or code / files for a whole component.
- Add what sharpens it:
language/framework, and context for the trust boundaries (e.g. "public internet-facing API", "internal service behind VPN", "handles untrusted uploads").
- Choose
standard: owasp, cwe, or both (default).
- Call
security_review({ code | diff | files, language?, context?, standard? }).
- Relay findings led by the highest severity — each has a CWE/OWASP ref, a short exploitability sketch, and a concrete fix. Offer to apply the top fix.
For code you are authorized to review. Requires OPENROUTER_API_KEY. If the tool returns its missing-key error, relay it and suggest /setup.
