security-review

name	security-review
description	Security-focused code audit. Checks OWASP Top 10, secrets exposure, and vulnerability patterns. Invokes the security-reviewer agent.
user-invocable	true

/security-review - Security Audit

Invoke the security-reviewer agent for a focused security analysis.

Usage

/security-review                # Review all recent changes
/security-review src/api/       # Review specific path
/security-review --owasp        # Full OWASP Top 10 checklist
/security-review --deps         # Focus on dependency vulnerabilities

What Gets Checked

Automated Scans

• Hardcoded secrets and API keys
• Vulnerable dependencies (npm audit / pip-audit / cargo audit)
• Console.log/debug statements in production code

Manual Review (OWASP Top 10)

• A01: Broken Access Control
• A02: Cryptographic Failures
• A03: Injection (SQL, XSS, command)
• A04: Insecure Design
• A05: Security Misconfiguration
• A06: Vulnerable Components
• A07: Authentication Failures
• A08: Data Integrity Failures
• A09: Logging Failures
• A10: SSRF

Output

## Security Audit Report

**Risk Level**: CRITICAL / HIGH / MEDIUM / LOW

### Findings by Severity
- CRITICAL: [Must fix immediately]
- HIGH: [Fix before merge]
- MEDIUM: [Fix when possible]

Each finding includes:
- CWE reference
- File and line location
- Vulnerable code snippet
- Remediation with secure code

When to Use

• After code touching authentication or authorization
• After adding API endpoints accepting user input
• After modifying database queries
• Before any production deployment
• After adding or updating dependencies