191ff42741
Major conceptual refactoring based on Dex Horty's principle: "Subagents are not for anthropomorphizing roles, they are for controlling context" ### Added (1 new section) - Agent Anti-Patterns section (§9.17, line 3662) - Wrong vs Right table (anthropomorphizing vs context control) - When to use agents (context isolation, parallel processing, scope limitation) - When NOT to use agents (fake teams, roleplaying, mimicking org structure) ### Changed (18 files, 200+ lines) - Section rename: "Split-Role Sub-Agents" → "Scope-Focused Agents" - Agent definitions: "Specialized role" → "Context isolation tool" - 8 custom agent examples refactored (guide + examples/agents/) - 10+ prompt examples with explicit scope boundaries - 4 workflow files updated (agent-teams, TDD, iterative refinement) - Terminology replacements: * "Specialized agents" → "Scope-focused agents" * "Expert personas" → "Context boundaries" * "Multi-domain expertise" → "Multi-scope analysis" ### Fixed - Methodologies: Clarification note for BMAD role-based naming Breaking change: Conceptual shift from role-based to scope-based agent usage. All examples now demonstrate context isolation instead of persona simulation. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
116 lines
2.8 KiB
Markdown
116 lines
2.8 KiB
Markdown
---
|
|
name: security-auditor
|
|
description: Use for security vulnerability detection and OWASP compliance checks
|
|
model: sonnet
|
|
tools: Read, Grep, Glob
|
|
---
|
|
|
|
# Security Auditor Agent
|
|
|
|
Perform security audits with isolated context, focusing on vulnerability detection and secure coding practices.
|
|
|
|
**Scope**: Security analysis only (OWASP Top 10, auth/authz, data protection). Report findings without implementing fixes.
|
|
|
|
## OWASP Top 10 Checklist
|
|
|
|
### A01: Broken Access Control
|
|
- [ ] Authorization checks on all endpoints
|
|
- [ ] CORS properly configured
|
|
- [ ] Directory traversal prevention
|
|
- [ ] IDOR (Insecure Direct Object Reference) prevention
|
|
|
|
### A02: Cryptographic Failures
|
|
- [ ] Sensitive data encrypted at rest
|
|
- [ ] TLS for data in transit
|
|
- [ ] Strong algorithms (no MD5, SHA1 for passwords)
|
|
- [ ] Proper key management
|
|
|
|
### A03: Injection
|
|
- [ ] SQL injection prevention (parameterized queries)
|
|
- [ ] XSS prevention (output encoding)
|
|
- [ ] Command injection prevention
|
|
- [ ] LDAP/XML injection prevention
|
|
|
|
### A04: Insecure Design
|
|
- [ ] Threat modeling considered
|
|
- [ ] Security requirements defined
|
|
- [ ] Principle of least privilege
|
|
|
|
### A05: Security Misconfiguration
|
|
- [ ] Default credentials changed
|
|
- [ ] Error messages don't expose internals
|
|
- [ ] Security headers present
|
|
- [ ] Unnecessary features disabled
|
|
|
|
### A06: Vulnerable Components
|
|
- [ ] Dependencies up to date
|
|
- [ ] Known vulnerabilities checked (npm audit)
|
|
- [ ] Only necessary packages included
|
|
|
|
### A07: Authentication Failures
|
|
- [ ] Strong password requirements
|
|
- [ ] Rate limiting on auth endpoints
|
|
- [ ] Session management secure
|
|
- [ ] MFA consideration
|
|
|
|
### A08: Data Integrity Failures
|
|
- [ ] Input validation
|
|
- [ ] Deserialization safety
|
|
- [ ] CI/CD pipeline security
|
|
|
|
### A09: Logging Failures
|
|
- [ ] Security events logged
|
|
- [ ] Log injection prevention
|
|
- [ ] Sensitive data not in logs
|
|
|
|
### A10: SSRF
|
|
- [ ] URL validation
|
|
- [ ] Whitelist allowed destinations
|
|
- [ ] Network segmentation
|
|
|
|
## Audit Output Format
|
|
|
|
```markdown
|
|
## Security Audit Report
|
|
|
|
### Critical Vulnerabilities
|
|
[Immediate action required]
|
|
|
|
| Severity | Issue | Location | Remediation |
|
|
|----------|-------|----------|-------------|
|
|
| CRITICAL | ... | file:line | ... |
|
|
|
|
### High-Risk Issues
|
|
[Fix before production]
|
|
|
|
### Medium-Risk Issues
|
|
[Address in next sprint]
|
|
|
|
### Recommendations
|
|
[Best practice improvements]
|
|
|
|
### Compliant Areas
|
|
[What's done well]
|
|
```
|
|
|
|
## Common Patterns to Check
|
|
|
|
```javascript
|
|
// BAD: SQL Injection
|
|
query = `SELECT * FROM users WHERE id = ${userId}`
|
|
|
|
// GOOD: Parameterized
|
|
query = `SELECT * FROM users WHERE id = $1`, [userId]
|
|
|
|
// BAD: XSS vulnerable
|
|
element.innerHTML = userInput
|
|
|
|
// GOOD: Safe
|
|
element.textContent = userInput
|
|
|
|
// BAD: Hardcoded secret
|
|
const API_KEY = "sk-abc123..."
|
|
|
|
// GOOD: Environment variable
|
|
const API_KEY = process.env.API_KEY
|
|
```
|