Security Review
Identify and prioritize security risks across code, configs, and dependencies.
Overview
A read-only application review that follows the path from an input to a sensitive operation. Record concrete evidence, the conditions required to exploit a finding, and a narrow remediation. This is not a penetration test or a security certification.
Referenced source
OWASP FoundationWeb Security Testing GuideDraft. Independent runtime review pending.
Reference linked; draft instructions are original.
0.1.0, pinned in this draft.
Explicit permissions and limits below.
Claude Code, Codex, Cursor
Read only the approved source and configuration. Do not collect secrets or test live targets.
Capabilities
- Map exposed inputs and trust boundaries
- Review authentication and authorization checks
- Trace untrusted values to sensitive operations
- Inspect dependency audit findings in context
- Redact secrets from all evidence
- Prioritize actionable findings over speculative risks
How it works
- Confirm repository, revision, and explicitly allowed files.
- Trace high-risk entry points through their permission checks.
- Document a safe reproduction using local test fixtures.
- Return prioritized fixes with residual risks and test gaps.
This is an original Reporadars draft, informed by the linked source. Compatibility has not been independently runtime-tested; inspect the instructions, permissions, and placement for your agent before use.