security-review

Run an AI-powered security review of code changes in this repository. Detects vulnerabilities across injection, authentication/authorization, data exposure, cryptography, input validation, race conditions, XSS/code execution, insecure configuration, and supply chain. For codebases that integrate LLMs, AI agents, or Model Context Protocol clients, five additional MAESTRO-derived classes activate when a file imports a recognized LLM/agent/MCP SDK: prompt injection, tool abuse, agent trust boundary, model output execution, and vector store poisoning. Filters out low-impact noise (denial-of-service, rate-limiting, memory-exhaustion).

What to do

Follow these steps in order. Do NOT skip steps. The command is a pipeline: parse args → gather input → dispatch agent → render output.

Step 1: Parse arguments

The user invoked you with the arguments $ARGUMENTS. Treat them as a space-separated list and walk the tokens in any order:

• If --full appears anywhere in the list, set FULL_MODE=true and remove that token from the list. Otherwise FULL_MODE=false. This selects between the two scan modes documented in the plugin README: diff (default) reviews working-tree changes against HEAD; full reviews tracked files end-to-end.
• If --json appears anywhere in the list, set JSON_MODE=true and remove that token from the list. Otherwise JSON_MODE=false.
• If --sarif appears anywhere in the list, set SARIF_MODE=true and remove that token from the list. Otherwise SARIF_MODE=false. This activates SARIF v2.1.0 output (see Step 5). --sarif and --json are MUTUALLY EXCLUSIVE: their top-level JSON shapes are incompatible (one is the agent's native schema, the other is the SARIF document). If both flags are present, run a final exit 2 via Bash with one stderr line --sarif and --json are mutually exclusive — do NOT proceed and do NOT pick one silently. When both flags are absent, output is the human-readable report.
• If --maestro appears anywhere in the list, set MAESTRO_MODE=true and remove that token from the list. Otherwise MAESTRO_MODE=false. This activates MAESTRO 7-layer classification — each finding's JSON gains a maestro_layer field, and the human-readable output adds a "By MAESTRO layer" subsection grouping findings by architectural layer. When MAESTRO_MODE=false, the maestro_layer field MUST NOT appear in the JSON document (preserves byte-identical output for callers that don't opt in). See Cloud Security Alliance's MAESTRO framework for the seven-layer model.
• If --rci appears, look at the NEXT token. If it parses as an integer of at least 1, consume it and set RCI_PASSES to the minimum of that value and 3 — out-of-range values are silently clamped to the cap of 3 (which bounds cost), never rejected. If the next token is missing, is not an integer, or is an integer less than 1 (zero or negative), do NOT consume it — leave it in the token list for the other bullets (so a path immediately following bare --rci is never eaten as a pass count) — and default RCI_PASSES=1. If --rci is absent, RCI_PASSES=0 (no recursive criticism, single dispatch as today). RCI = Recursive Criticism & Improvement: after the standard dispatch produces a findings document, run RCI_PASSES additional critique-and-refine dispatches that receive both the prior pass's JSON AND the original input, and asks the agent to drop false positives and surface anything that was missed. OpenSSF documents this technique as reducing security weaknesses by up to an order of magnitude. Combining --rci with --full is supported but expensive — N=2 over a 41-batch full scan is 41+82 = 123 agent dispatches. See Step 4.5 below for the iteration loop. Worked examples — every input shape has exactly one result: