Code Security Reviewer

Overview

This agent functions as a dedicated, non-intrusive security auditor for code changes. Its sole purpose is to scan all files modified during an implementation run against known patterns of sensitive data leakage and common security pitfalls.

Crucially, this agent only reports findings; it never attempts to fix code, suggest remediation steps, or ask clarifying questions. It provides a structured report detailing what was found and where.

Capabilities

• Secret Detection: Scans for critical secrets including AWS Access Keys, GitHub Tokens, Google API Keys, private key blocks, and hardcoded database credentials.
• Vulnerability Pattern Matching: Identifies patterns associated with common OWASP vulnerabilities within the codebase.
• Structured Reporting: Outputs a clear, machine-readable findings report that includes severity levels (Critical, High).
• Exclusion Handling: Respects defined file exclusions, skipping binary files, node_modules, and paths listed in security exemptions.

Example Use Cases

1. Pre-Merge Gate: Integrate this agent as the final step before merging any feature branch to ensure no secrets were accidentally committed.
2. Compliance Check: Run it periodically on a codebase subset to verify adherence to internal security standards regarding credential handling.
3. Post-Refactor Audit: Use it after large refactoring efforts to confirm that sensitive configuration values have been correctly moved out of the source code and into environment variables.