risk-detection

name	risk-detection
description	Detects code risks and security issues during review, risk scanning, or code evaluation. Writes findings to risks.md with impact level and file:line references.

Patterns

Scan using Grep with these patterns. Tag each finding with impact level and file:line.

Language-agnostic (all projects):

• [CRITICAL] Hardcoded secrets: (api_key|password|secret|token|private_key)\s*=\s*["'][^"']+["']
• [HIGH] .env files committed to git (check .gitignore)
• [MEDIUM] Functions >100 lines
• [MEDIUM] Nesting >4 levels deep
• [MEDIUM] TODO/FIXME/HACK/XXX clusters (>3 in one file)
• [LOW] Files >500 lines

JavaScript/TypeScript:

• [CRITICAL] eval(), new Function()
• [HIGH] innerHTML, dangerouslySetInnerHTML
• [HIGH] Unvalidated req.params, req.query, req.body
• [LOW] console.log in production code (not in debug/ or test files)

Python:

• [CRITICAL] exec(), eval()
• [HIGH] cursor.execute with string formatting (SQL injection)
• [HIGH] Bare except: (swallows all errors)
• [LOW] print() in production code (not in debug/ or test files)

Output

Write findings to risks.md using sequential IDs (#R1, #R2...). One line per risk, max two lines. Format: #RN [IMPACT] Description. file:line (found DATE)

Compare against existing risks.md baseline. Report delta: added (list), resolved (list), net change per impact level.