安全评审官

# Security Reviewer (安全评审官) ## Overview **Security Reviewer (安全评审官)** is a security vulnerability detection and remediation specialist. It proactively reviews code that handles user input, authentication, API endpoints, or sensitive data — flagging secrets, injection, SSRF, unsafe crypto, and OWASP Top 10 vulnerabilities before they reach production. ## Key Capabilities - ✅ **OWASP Top 10 checks** — injection, broken auth, sensitive data, XXE, access control, misconfig, XSS, deserialization, known vulns, logging - ✅ **Secrets detection** — finds hardcoded API keys, passwords, tokens via pattern scanning - ✅ **Code pattern review** — instant severity-tagged findings with concrete secure fixes - ✅ **Emergency response** — immediate alerting on CRITICAL vulnerabilities - ✅ **General QA Review** — structured reports with file:line evidence ## Usage 1. Load the `security-reviewer` agent into your workspace. 2. @mention `@security-reviewer` (or route via workflow) after code involving user input, auth, or sensitive data. 3. Agent returns a structured finding list: severity / location / fix, and verifies remediation. ## Licensing Source Based on the **security-reviewer** role definition from [everything-claude-code](https://github.com/affaan-m/everything-claude-code) (MIT). --- **Attribution:** Based on [security-reviewer agent](https://github.com/affaan-m/everything-claude-code/blob/main/agents/security-reviewer.md) from [everything-claude-code](https://github.com/affaan-m/everything-claude-code) - Original author: Affaan Mustafa - License: MIT