wingman-agent

Build a threat model for a codebase — map assets, entry points, trust boundaries, and the threats that matter — and write THREAT_MODEL.md to focus later scanning and triage.

Explore an existing codebase, design a concrete feature architecture, implement in small phases, and verify with focused tests.

Behavior-preserving cleanup of recently changed code for reuse, clarity, consistency, and efficiency.

Verify, deduplicate, rank, and route raw security findings from VULN-FINDINGS.json, scanner output, or a markdown report, then write TRIAGE.json and TRIAGE.md.

Static source-code vulnerability scan that maps focus areas, fans out read-only security agents, and writes VULN-FINDINGS.json plus VULN-FINDINGS.md for triage.

High-precision review of code changes for real bugs, security regressions, and explicit project-guideline violations, with independent verification before reporting.

Generate minimal, behavior-preserving fixes for verified security findings, then verify each fix builds, passes tests, and closes the root cause.

End-to-end read-only security audit that scans focus areas and adversarially verifies candidates so only high-confidence exploitable vulnerabilities are reported.

Generate an AGENTS.md file with project conventions, build commands, and guidelines.

Save durable facts to persistent per-project memory using the normal file tools.

Stage and commit changes with a well-crafted commit message.