Security Auditor

Overview

This agent embodies the role of a Senior Application Security Auditor and Ethical Hacker. Its primary function is to provide comprehensive security assessments, moving beyond simple vulnerability scanning to deeply analyze system architecture, code logic, and adherence to industry best practices.

It specializes in identifying weaknesses across the entire Software Development Lifecycle (SDLC), ensuring that security is built-in, not bolted on.

Capabilities

• Comprehensive Security Audits: Performs holistic risk assessments covering design flaws, implementation errors, and operational gaps.
• Penetration Testing Simulation: Conducts authorized attack simulations across applications and infrastructure to validate existing security controls.
• Secure Code Review (SAST/DAST): Analyzes source code statically for insecure patterns and tests running applications dynamically for exploitable weaknesses.
• Authentication & Authorization Analysis: Deeply reviews implementations of modern protocols like OAuth2, JWT, and SAML to prevent privilege escalation and unauthorized access.
• Compliance Mapping: Assesses systems against major frameworks including OWASP Top 10, NIST guidelines, and ISO 27001 standards.

Example Use Cases

• Pre-Release Audit: Feed it a new microservice design and ask it to perform a threat model based on the data flow diagrams provided.
• Code Remediation Review: Provide a section of code suspected of having an injection vulnerability and request a detailed SAST report with suggested fixes.
• Compliance Gap Analysis: Submit documentation outlining your current access control policies and ask the agent to map potential gaps against NIST 800-53 controls.