VanaraVANARAagentsSubscribe — $10/mo
freeagentv2.0.0✓ verified

security-auditor

Use PROACTIVELY before commits/merges and whenever code touches auth, user input, secrets, file paths, DB queries, deserialization, or outbound requests. Audits against the OWASP Top 10, traces untrusted data to dangerous sinks, and reports vulnerabilities by severity with concrete fixes and a merge verdict.

$npx vanara install security-auditor

Free & open source (Apache-2.0) — view the source on GitHub.

Overview

You are a senior application security engineer running a focused code audit. Your job is to find exploitable vulnerabilities *before an attacker does* — and to prove each one is real by tracing how untrusted input reaches a dangerous sink. You think in terms of data flow and trust boundaries, not whether the code "looks tidy". A linter checks style; you check whether the system can be broken.

What it covers

Details

Tier
Free
Version
2.0.0
Model
claude-sonnet-4-6
Tools
Read, Grep, Glob, Bash
Depth
3 references · 2 examples · 1 runnable scripts
Verification
1/1 runnable checks passing ✓
Runs on
Your own Claude Code — no API keys
accessibility-auditorUse when auditing an existing UI for WCAG 2.2 A/AA conformance. Investigates semantics, keyboard operability, focus, color contrast, ARIA, forms, and reduced-motion, then reports findings per success criterion with severity and concrete fixes. Read-only — audits, does not refactor.ai-engineerUse PROACTIVELY when building or hardening LLM-powered features (chatbots, RAG, agents, summarizers, extractors, classifiers). Picks the right pattern (prompt → RAG → tools → agent), the right model tier, and ships with evals, guardrails, and cost/latency budgets.api-designerUse when designing a new HTTP/GraphQL API or changing an existing one — modeling resources, defining endpoint contracts, choosing status codes, pagination, filtering, error envelopes, versioning, and idempotency. Produces a reviewable API contract plus an OpenAPI snippet, not production code.api-documenterUse when documenting an HTTP/REST or GraphQL API for external or internal consumers — turning routes, schemas, or an OpenAPI spec into accurate reference docs with request/response examples, error catalogues, auth, pagination, and a getting-started guide. Read-only; produces docs, not code.app-release-managerUse when preparing a mobile app release or store submission. Walks through versioning, build config, store metadata, and the review-readiness checklist to avoid rejections.budget-plannerUse when building, reviewing, or stress-testing a budget. Turns priorities into a realistic allocation of money, tracks budget vs. actuals, forecasts cash flow and runway, and flags variances and shortfall risks early with concrete corrective actions.
← All agents