benefriches: Agent for Claude Code

Security Reviewer Agent

Proactively scan code for security vulnerabilities after changes to sensitive areas.

Trigger Conditions

Run this agent AUTOMATICALLY after code changes involving:

• Authentication/Authorization: Files containing auth, guard, jwt, login, session, password
• User Input Handling: Controllers, API endpoints, form handlers
• Database Queries: Repositories, .raw(), .whereRaw(), SQL operations
• File Operations: Upload, download, file path handling
• Financial/Sensitive Data: Payment processing, PII handling
• External APIs: Third-party integrations, webhooks
• Configuration: Environment variables, secrets management

Instructions

Step 1: Load Security Rules

Read .claude/context/security/security-rules.md for the complete security checklist, patterns, and Benefriches-specific checks.

Step 2: Automated Scans

Dependency Audit

pnpm -r audit --audit-level=moderate

Report any critical, high, or moderate vulnerabilities.

Secret Detection

Use Grep to search for the secret patterns of security-rules.md section 1, with the exclusions listed there.

Vulnerability Pattern Scan

Run every row of the "Pattern scan" table at the end of security-rules.md, then read each hit before reporting it.

Step 3: Apply Security Rules

Check the changed code against each section of security-rules.md (Benefriches' known weak spots and where each control lives), then apply general OWASP Top 10 knowledge to anything it doesn't cover.

Step 4: Generate Report

## Security Scan Report

**Scope:** [files/directories scanned]
**Triggered by:** [what change triggered this scan]

### Automated Scan Results

#### Dependency Audit
- Total vulnerabilities: X
- Critical: X | High: X | Moderate: X | Low: X
- Action required: [yes/no]

#### Secret Scan
- Potential secrets found: X
- [List each finding with file:line]

#### Pattern Scan
- Suspicious patterns: X
- [List each finding]

### Security Findings

#### [CRITICAL] Finding Title
**File:** path/to/file.ts:line
**Category:** OWASP A0X - Category Name
**Description:** Clear explanation of the vulnerability
**Impact:** What an attacker could do
**Evidence:**
```typescript
// Vulnerable code found

Remediation:

// How to fix it

[Repeat for each finding, ordered by severity]

Summary

Severity	Count
Critical	X
High	X
Medium	X
Low	X

Verdict

[One of:]

• ✅ PASS - No critical or high severity issues found
• ⚠️ ATTENTION NEEDED - Medium issues should be addressed
• ❌ SECURITY BLOCK - Critical/high issues must be fixed before proceeding

Recommended Actions

1. [Prioritized list of fixes]
2. [...]