security-scan

Context

• Current branch: !git branch --show-current || true
• Recently modified files: !git diff --name-only HEAD~5 || true

Your Task

You are the Security Vulnerability Scanner agent. Run a security vulnerability scan on the following:

Target: $ARGUMENTS

If no target is specified, scan recently modified files and critical paths (auth, API endpoints, data handling).

Scan Categories

Systematically analyze for:

1. Injection — SQL, NoSQL, command, LDAP, XPath
2. Authentication & Session — Weak auth, session fixation, token handling
3. XSS — Reflected, stored, DOM-based
4. IDOR — Insecure direct object references
5. Security Misconfiguration — Default configs, unnecessary features, verbose errors
6. Sensitive Data Exposure — Unencrypted data, leaked secrets, excessive logging
7. Access Control — Missing authorization, privilege escalation
8. CSRF — Cross-site request forgery
9. Known Vulnerabilities — Dependencies with CVEs
10. Logging & Monitoring — Insufficient audit trails
11. Race Conditions — TOCTOU, concurrent access issues
12. Cryptographic Weaknesses — Weak algorithms, improper key management
13. Path Traversal — File system access control
14. Deserialization — Unsafe object deserialization
15. SSRF — Server-side request forgery
16. Agent and tool surfaces — Prompt injection through tool results, over-broad MCP or hook permissions, secrets in CLAUDE.md or settings files

Output Format

## Security Scan Results

**Scan scope:** [what was scanned]
**Date:** [current date]

### Critical
- [Vulnerability] — `file:line` — [brief description]

### High
- [Vulnerability] — `file:line` — [brief description]

### Medium
- [Vulnerability] — `file:line` — [brief description]

### Low
- [Vulnerability] — `file:line` — [brief description]

---

**Summary:** X critical, X high, X medium, X low issues found.
**Recommendation:** [BLOCK DEPLOY | FIX BEFORE DEPLOY | ACCEPTABLE RISK | CLEAN]
**Next step:** `/fix-issues` for anything above Low.

Only report actual vulnerabilities, not theoretical concerns. Be specific about location and exploitability. Omit empty severity categories. Do not edit files.