security

/security - 安全审计工作流

针对敏感代码的专门安全分析。

使用场景

• “安全审计”
• “检查是否存在漏洞”
• “这样安全吗？”
• “审查身份验证代码”
• “检查注入攻击”
• 处理身份验证、支付和用户数据之前
• 添加安全敏感功能之后

工作流概述

┌─────────┐    ┌───────────┐
│  aegis  │───▶│ arbiter  │
│         │    │           │
└─────────┘    └───────────┘
  Security       Verify
  audit          fixes

Agent 顺序

#	Agent	角色	输出
1	aegis	全面安全扫描	漏洞报告
2	arbiter	验证修复并运行安全测试	验证报告

为什么需要专门的安全工作流？

/review 工作流侧重代码质量。安全工作需要：

• 专门的漏洞模式
• 依赖项扫描
• 秘密检测
• OWASP Top 10 检查
• 身份验证／授权审查

执行

阶段 1：安全审计

Task(
  subagent_type="aegis",
  prompt="""
  Security audit: [SCOPE]

  Scan for:

  **Injection Attacks:**
  - SQL injection
  - Command injection
  - XSS (Cross-Site Scripting)
  - LDAP injection

  **Authentication/Authorization:**
  - Broken authentication
  - Session management issues
  - Privilege escalation
  - Insecure direct object references

  **Data Protection:**
  - Sensitive data exposure
  - Hardcoded secrets/credentials
  - Insecure cryptography
  - Missing encryption

  **Configuration:**
  - Security misconfigurations
  - Default credentials
  - Verbose error messages
  - Missing security headers

  **Dependencies:**
  - Known vulnerable packages
  - Outdated dependencies
  - Supply chain risks

  Output: Detailed report with:
  - Severity (CRITICAL/HIGH/MEDIUM/LOW)
  - Location (file:line)
  - Description
  - Remediation steps
  """
)

阶段 2：验证（修复之后）

Task(
  subagent_type="arbiter",
  prompt="""
  Verify security fixes: [SCOPE]

  Run:
  - Security-focused tests
  - Dependency audit (npm audit, pip audit)
  - Re-check reported vulnerabilities
  - Verify fixes don't introduce regressions

  Output: Verification report
  """
)

安全范围

整个代码库

User: /security
→ Scan entire codebase

特定区域

User: /security authentication
→ Focus on auth-related code

单个文件

User: /security src/api/auth.py
→ Deep dive on one file

仅依赖项

User: /security --deps
→ Only dependency vulnerabilities

示例

User: /security the payment processing code

Claude: Starting /security audit for payment code...

Phase 1: Security audit...
[Spawns aegis]

┌─────────────────────────────────────────────────────────────┐
│ Security Audit Report                                       │
├─────────────────────────────────────────────────────────────┤
│ Scope: src/services/payment/                                │
│ Files scanned: 12                                           │
│ Lines analyzed: 2,847                                       │
├─────────────────────────────────────────────────────────────┤
│ CRITICAL (1)                                                │
│ ──────────                                                  │
│ [C1] SQL Injection in payment.py:89                         │
│      query = f"SELECT * FROM orders WHERE id = {order_id}"  │
│      Fix: Use parameterized queries                         │
│                                                             │
│ HIGH (2)                                                    │
│ ────────                                                    │
│ [H1] Hardcoded API key in stripe_client.py:12               │
│      STRIPE_KEY = "sk_live_..."                             │
│      Fix: Move to environment variable                      │
│                                                             │
│ [H2] Missing input validation in refund.py:45               │
│      amount = request.json['amount']  # No validation       │
│      Fix: Validate amount is positive number                │
│                                                             │
│ MEDIUM (1)                                                  │
│ ──────────                                                  │
│ [M1] Verbose error messages in error_handler.py:23          │
│      return {"error": str(e)}  # Leaks internal details     │
│      Fix: Return generic message, log details internally    │
│                                                             │
│ LOW (0)                                                     │
│ ───────                                                     │
│ None                                                        │
├─────────────────────────────────────────────────────────────┤
│ Summary: 1 critical, 2 high, 1 medium, 0 low                │
│ Status: BLOCKING - Fix critical issues before release       │
└─────────────────────────────────────────────────────────────┘

Fix the critical and high issues, then run:
/security --verify

修复之后

User: /security --verify

Claude: Phase 2: Verifying fixes...
[Spawns arbiter]

✅ C1: SQL injection fixed - using parameterized queries
✅ H1: API key moved to environment variable
✅ H2: Input validation added
✅ M1: Error messages sanitized

All security tests passing.
Security audit: PASSED

OWASP Top 10 覆盖范围

风险	已检查
A01 访问控制失效	✅
A02 加密机制失效	✅
A03 注入	✅
A04 不安全设计	✅
A05 安全配置错误	✅
A06 易受攻击的组件	✅
A07 身份验证失效	✅
A08 软件和数据完整性失效	✅
A09 安全日志记录和监控失效	✅
A10 SSRF	✅

标志

• --deps：仅检查依赖项
• --verify：修复后重新运行
• --owasp：生成明确的 OWASP Top 10 报告
• --secrets：重点检测秘密信息