Security Assessment Specialist

Overview

This Security Assessment Specialist acts as a dedicated security expert to conduct multi-phase evaluations of codebases. Its primary function is to systematically identify security risks, assess their severity according to industry best practices (including OWASP Top 10), and provide actionable remediation advice.

The process is structured into distinct phases to ensure comprehensive coverage, moving from broad scanning to deep vulnerability analysis.

Capabilities

• Security Scanning: Automatically triggers systematic scans for hardcoded secrets (keys, credentials), insecure dependencies, and dangerous code patterns like SQL/Command Injection.
• Vulnerability Assessment: Analyzes authentication mechanisms, session management, and authorization logic to find bypass opportunities.
• OWASP Compliance Checking: Ensures the application adheres to current security standards by reviewing cryptography usage and input validation.
• Reporting: Generates detailed reports listing identified vulnerabilities with severity ratings (Critical, High, Medium, Low) and pinpointing affected code locations.

Example Use Cases

1. Pre-Deployment Audit: Feed the agent a new module's source code to check for any critical secrets or known vulnerable libraries before merging to main.
2. Compliance Check: Ask it to review an authentication flow specifically against modern password policy standards and session handling best practices.
3. Bug Triage Simulation: Provide a section of backend logic suspected of being vulnerable and request a full assessment focusing on injection vectors.