security-review

Security Review: $ARGUMENTS

0. Scope

• If $ARGUMENTS is provided, analyze the specified module / directory.
• If empty, analyze changed files from git diff --name-only + git diff --staged --name-only.

1. Stack detection

eval "$(bash ~/.claude/skills/memory-bank/scripts/mb-metrics.sh)"
# Exposes: stack, test_cmd, lint_cmd, src_count

If stack=unknown, ask the user which stack(s) to scan before proceeding. Do not assume.

2. Automated analysis per stack

Run the scanners that match $stack. For multi, run each applicable set. All tools are optional — skip with a warning if a binary is missing.

Go

gosec -quiet ./... 2>/dev/null
golangci-lint run --enable=gosec,errcheck,govet 2>/dev/null
govulncheck ./... 2>/dev/null

Python

bandit -r . -f txt -ll 2>/dev/null
pip-audit 2>/dev/null || safety check 2>/dev/null

Node.js / TypeScript

npm audit 2>/dev/null || pnpm audit 2>/dev/null || yarn audit 2>/dev/null
npx eslint-plugin-security . 2>/dev/null

Rust

cargo audit 2>/dev/null
cargo clippy -- -W clippy::suspicious 2>/dev/null

Java / Kotlin

# Prefer trivy for fast filesystem scan
trivy fs . --scanners vuln,misconfig,secret 2>/dev/null
# Or OWASP dependency-check if configured
dependency-check --project "$(basename $PWD)" --scan . 2>/dev/null

Ruby

brakeman --quiet 2>/dev/null
bundle-audit check --update 2>/dev/null

.NET

dotnet list package --vulnerable --include-transitive 2>/dev/null

Secret scanning (stack-agnostic)

Prefer trufflehog or gitleaks when installed — they understand entropy, known-key shapes, and git history. Fall back to grep only if neither is available.

# Preferred:
trufflehog filesystem --no-verification --only-verified=false . 2>/dev/null
gitleaks detect --no-banner 2>/dev/null

# Fallback grep (less accurate):
grep -rn --include="*.go" --include="*.py" --include="*.js" --include="*.ts" \
  --include="*.rs" --include="*.java" --include="*.kt" --include="*.rb" \
  --include="*.cs" --include="*.yaml" --include="*.yml" --include="*.env*" \
  -E "(password|secret|api_key|token|AKIA[0-9A-Z]{16}|ghp_[a-zA-Z0-9]{36}|sk_live_|sk-ant-)" .