Audit the code for vulnerabilities, leaked secrets and risky dependencies before it ships.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
Delegate to Sentinel for comprehensive security review.
"Every line of code is guilty until proven innocent."
# What changed?
git diff --name-only HEAD~10 2>/dev/null || git diff --name-only
# What's the scope?
ls -la
Delegate to Sentinel agent:
"Sentinel, security audit time.
Scope: {describe what changed or focus area}
Run your full checklist:
1. Secrets scan
2. Dependency audit
3. Injection vectors
4. Auth/authz review
5. Crypto check
Files changed: {list from git diff}
Be thorough. We're not shipping vulnerabilities."
Sentinel returns findings by severity:
If CRITICAL or HIGH found:
Security audit found issues:
CRITICAL:
- [Issue 1 with location and fix]
HIGH:
- [Issue 2 with location and fix]
Options:
1. Fix now (Bob will implement Sentinel's fixes)
2. Fix manually, run /dev-security again
3. Accept risk (requires explicit acknowledgment)
4. Get second opinion (run deeper audit)
If only MEDIUM/LOW:
Security audit passed with notes.
MEDIUM:
- [Issue with suggestion]
LOW:
- [Issue with suggestion]
These don't block shipping but should be tracked.
Add to backlog? (y/n)
If clean:
Security audit passed!
Sentinel says: "Huh. Someone actually read the OWASP guide. Respect."
Ready for:
- /dev-rc - Release candidate
- /dev-finish - Close the cycle
If active dev-cycle session:
## Security Audit
- **Date**: {timestamp}
- **Status**: PASSED | PASSED_WITH_NOTES | FAILED
- **Critical**: 0
- **High**: 0
- **Medium**: 2
- **Low**: 1
### Findings
{Summary of what was found and resolved}
/dev-security
Everything: secrets, deps, code, config, infra
/dev-security quick
Just the critical stuff: secrets, known CVEs, obvious injection
/dev-security auth
/dev-security crypto
/dev-security deps
/dev-security secrets
Focus on one area for deeper review.
| Area | What | Why |
|---|---|---|
| Secrets | Hardcoded keys, tokens, passwords | #1 breach cause |
| Dependencies | Known CVEs, outdated packages | Supply chain attacks |
| Injection | SQL, XSS, command, path traversal | OWASP Top 10 |
| Auth | Broken auth, missing authz | Gateway to everything |
| Crypto | Weak algorithms, hardcoded keys | Data protection |
| Config | Exposed debug, permissive CORS | Misconfiguration |
With dev-cycle: Logs findings to session With dev-rc: Security must pass for release candidate With Bob: Implements fixes for findings With Sentinel: The security brain
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Branch and commit conventions that keep an agent's work reviewable — one branch per task, main stays clean, nothing force-pushed.
The English summary is being prepared. Showing the original description.
Look up how Claude Code itself works — hooks, skills, subagents, MCP, plugins, settings — from the official docs, so answers come from the current spec instead of memory.
The English summary is being prepared. Showing the original description.
Design better agents, skills and hooks for Claude Code, checking the current spec instead of guessing at fields.
The English summary is being prepared. Showing the original description.
Run a feature end to end — scout the code, plan it, build it, and keep a session file so a closed terminal doesn't lose the thread.
The English summary is being prepared. Showing the original description.
Close out a session — summarise what changed, capture what was learned, and prepare the commit.
The English summary is being prepared. Showing the original description.
Hand over a spec and walk away — plans, builds, tests and audits on its own, stopping only at a real blocker.
The English summary is being prepared. Showing the original description.