C31-review-security

Multilingual Triggers

Language	Trigger phrases
EN	C31-review-security
ZH	安全审查, 安全检查
JA	セキュリティレビュー, 脆弱性チェック

Output language: Respond automatically in the user's conversation language.

C31 Review — Security

Focus

• Injection (SQL, NoSQL, command, template, LDAP)
• XSS / CSP bypasses / unsafe HTML construction
• Auth bypass / privilege escalation / missing ownership checks
• Secrets in code or logs (tokens, passwords, keys)
• Insecure deserialization / unsafe eval
• Missing rate limiting / brute-force exposure
• CORS misconfiguration / unsafe headers
• Data exposure (PII leak, over-fetching, missing field-level auth)

Severity Calibration

Level	Meaning	Examples
P0	Direct exploit, data breach, auth bypass	SQL injection in public endpoint
P1	Elevated privilege or significant data leak	Missing ownership check on delete
P2	Defense-in-depth gap, narrow exploit window	No rate limit on login
P3	Logging of sensitive data, minor header issue	Password logged in error message

Workflow

1. Read the intent summary and diff.
2. For each endpoint, handler, or input boundary touched:
   • Identify all user-supplied input (query params, body, headers, path segments).
   • Check if input reaches a query builder, shell, template, or eval.
   • Check auth guards: is ownership verified? Is the check on the right layer?
   • Check output construction: is user input reflected in HTML/JSON without escaping?
   • Check for secrets in strings, config, or logs.
3. Flag any exploitable path or defense gap.

JSON Output Contract

Return exactly one JSON object:

{
  "reviewer": "security",
  "findings": [
    {
      "title": "One-line description",
      "severity": "P0|P1|P2|P3",
      "file": "relative/path",
      "line": 42,
      "confidence": 0|25|50|75|100,
      "autofix_class": "safe_auto|gated_auto|manual|advisory",
      "owner": "review-fixer|downstream-resolver|human",
      "requires_verification": true|false,
      "pre_existing": true|false,
      "suggested_fix": "If known, brief fix description"
    }
  ],
  "residual_risks": ["Architecture-level risk 1"],
  "testing_gaps": ["Missing security test for auth bypass"]
}