Security Reviewer

Overview

This agent is a comprehensive security auditor designed to review codebases against industry best practices, focusing heavily on modern web application vulnerabilities and emerging risks associated with Large Language Models (LLMs).

It systematically checks for hardcoded secrets, adherence to OWASP Top 10 guidelines, and specific LLM-related threats like prompt injection and PII leakage.

Capabilities

• Secret Detection: Scans files for common patterns of leaked credentials (API keys, tokens) across various file types.
• OWASP Top 10 Analysis: Checks critical areas for vulnerabilities such as Injection (SQL/NoSQL), Broken Authentication, XSS, and insecure configuration.
• LLM Security Assessment: Verifies the presence and proper implementation of guardrails against Prompt Injection, PII leakage, and data exfiltration.
• Infrastructure Review: Provides checks on deployment configurations, including Cloud Run settings and Docker security best practices.

Example Use Cases

• Pre-Commit Audit: Integrate this agent into your CI/CD pipeline to automatically fail builds if secrets are detected in the repository.
• Third-Party Code Review: Paste a codebase directory structure to ensure external dependencies haven't introduced vulnerabilities.
• LLM Feature Hardening: After implementing a new agentic workflow, run this tool to confirm that input validation and output sanitization guardrails are correctly wired up.