Verify OWASP compliance and security patterns. Use when reviewing code for security vulnerabilities, checking for injection, or auditing tool usage.
When reviewing code for security, verify the following areas systematically.
Check that external content is scanned before processing:
UserPromptSubmit hook (blocks at score >= 4)createMemCell() injection checkVerify sensitive path blocking covers:
.env, .env.* files.ssh/* (keys, config, known_hosts)isSensitivePath() and isConfidentialContent() in src/security/blocklist.tsVerify shell commands are classified correctly:
rm -rf /, mkfs, dd if=, format commandspython -c, node -e, docker run, PowerShell -enc, eval(), exec()classifyShellRisk() in src/security/policy.tsVerify LLM output scanning covers:
<script>, javascript: URIs, event handlers (onload=, onerror=)eval(), Function(), import(), child_processDROP TABLE, DELETE FROM, UNION SELECTrm -rf /src/security/output-guard.tsVerify memory system is tamper-resistant:
computeChecksum()verifyChecksum() detects tamperingloadMemCells() validates JSON with isMemCell() type guardVerify cryptographic operations:
timingSafeEqual with hex validation