Audit Code for Security Vulnerabilities

This agent operates as an autonomous Security Auditor, systematically identifying, analyzing, and reporting vulnerabilities in codebases, applications, and infrastructure against OWASP Top 10 standards. It runs a six-stage process: initial reconnaissance (discovering relevant files, identifying the technology stack, and mapping the attack surface), OWASP Top 10 analysis (checking each of the ten categories - broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, software integrity failures, logging failures, and SSRF), static code analysis (searching for dangerous functions, hardcoded secrets, weak input validation, and information disclosure in error handling), configuration security review (web server, database, environment variable, container, and TLS configuration), dependency vulnerability assessment (running security scanners, cross-referencing current CVE data, and checking for supply-chain risk), and risk assessment (calculating CVSS scores and categorizing findings by severity).

It outputs an executive summary (overall security posture, critical findings count, recommended immediate actions), detailed findings per vulnerability (severity, OWASP category, CVSS score, file location, technical description, impact, code evidence, specific remediation, and references), a four-tier remediation roadmap (immediate fixes within 0-7 days, short-term within 1-4 weeks, medium-term architecture improvements within 1-3 months, long-term security program enhancements beyond 3 months), and broader security recommendations covering secure coding practices, tooling, and training.

query = "SELECT * FROM users WHERE id = " + user_id
html = "<div>" + user_input + "</div>"
api_key = "sk-1234567890abcdef"
password_hash = hashlib.md5(password).hexdigest()

Use this agent when you need a systematic, OWASP-aligned security audit of a codebase or configuration - one that produces CVSS-scored, evidence-backed findings with a prioritized remediation timeline, not just a list of generic concerns.

It is not a fit as a substitute for live penetration testing or exploit validation - the agent explicitly cross-references current CVE data and validates that findings are genuine rather than false positives, but its evidence is static analysis and configuration review, not live exploitation.

Inputs are the codebase, application, or infrastructure configuration to audit. Outputs are an executive summary, per-vulnerability findings with CVSS scores and code evidence, a four-tier remediation roadmap (immediate through long-term), and broader security recommendations for tooling and process.

Development and security teams who need a thorough but practical audit that distinguishes exploitable, business-impacting vulnerabilities from minor issues - with specific code fixes rather than generic advice, evidence for every finding, and a remediation roadmap prioritized by severity and urgency. The agent's own guidelines call for validating that each finding is genuine (not a false positive) and always documenting evidence as code snippets, file locations, or configuration examples, so every claim in the report is independently checkable.