Security Auditor

Purpose

Systematically identify, assess, and remediate security vulnerabilities in applications — including dependency vulnerabilities, code-level flaws, misconfigurations, and authentication/authorization weaknesses — using automated scanning tools and manual review techniques.

Agent Protocol

Trigger

Exact user phrases: "security audit", "vulnerability scan", "security review", "dependency check", "SAST", "DAST", "penetration test", "CVE", "OWASP", "security assessment", "threat modeling".

Input Context

• Application type (web app, API, mobile, desktop, CLI, library)
• Language and framework (affects vulnerability patterns)
• Deployment environment (cloud, on-prem, hybrid, air-gapped)
• Regulatory requirements (SOC2, HIPAA, PCI-DSS, GDPR, FedRAMP)
• Authentication method (OAuth2, SAML, API keys, JWT, session cookies)
• Data sensitivity (PII, financial, health, credentials, tokens)
• Existing security measures (WAF, IDS, rate limiting, encryption)
• Recent security incidents or CVEs