Security: see references/scanner-notes.md and upstream SECURITY.md for expected scanner signals and trust model.
Verasic Secbot — Orchestration
Workflow
- Determine scope from the user's message: branch changes (default) or overrides (
uncommitted only, staged only, against <branch>). Invoke phrase beats defaults when both set.
- Resolve run settings from invoke-phrase overrides first, then inlined defaults in
references/config-schema.md:
| Setting |
Default |
scanner |
off |
strictness |
strict |
report.write |
true |
report.promote |
both |
trackedDir |
verasic |
localDir |
.verasic |
Invoke-phrase overrides: scope flags, strict / assertive, no file, save tracked, scanner override (off / opengrep / semgrep / auto).
3. Optional scanner: when scanner is not off, run scripts/run-scanner.sh <scanner> -- on changed source paths only (see references/scanner-adapter.md). Scanner missing → one-line skip, continue.
4. In Cursor: launch the verasic-secbot-reviewer subagent (.cursor/agents/verasic-secbot-reviewer.md) with repository path, scope, scanner results (if any), and resolved settings — in the foreground. Relay its report unchanged except strip harness paths, skill/rule names, protocol dumps, and internal config per verasic-agent-disclosure.
5. In any agent without subagents: read references/security-review-protocol.md and execute the review yourself in this conversation, following it exactly.
6. After relay: if the diff has no security surface (pure refactor, docs-only, styling), add one cross-tip line to /verasic-bugbot for general bug hunting. Never auto-chain.
Orchestration (Cursor)
Run a STRIDE-focused security review of local changes.
- Resolve run settings from invoke-phrase overrides first, then inlined defaults in
references/config-schema.md — do not read verasic.config.ts, .verasicrc.json, or .verasicrc.jsonc (no repo config skill in v0.2.0).
- When resolved
scanner is not off, run .cursor/skills/verasic-secbot/scripts/run-scanner.sh <scanner> -- (or .agents/skills/verasic-secbot/scripts/run-scanner.sh for cursor-hybrid installs) on changed paths per references/scanner-adapter.md before the LLM pass.
- Launch the
verasic-secbot-reviewer subagent in the foreground with:
Full Repository Path: <current workspace root>
Diff: branch changes (use uncommitted changes if I said so in my message)
Strictness: strict (use assertive if I said so)
Follow security-review-protocol.md fully: STRIDE, OWASP web checks, confidence legend, merge scanner + LLM findings, write artifacts per inlined defaults.
- Relay the subagent report verbatim — do not soften severities. Strip harness internals per verasic-agent-disclosure.
- If zero findings, say so plainly. Append one cross-tip line to
/verasic-bugbot only when the diff had no security-sensitive paths.
Source of truth
The full security review protocol (diff scope, STRIDE + OWASP, filtering, confidence, output, artifacts) lives in references/security-review-protocol.md. The Cursor subagent is a thin pointer to it; never duplicate the protocol elsewhere.
Checklists
checklists/security.md — shared with verasic-bugbot; apply on every run alongside STRIDE + OWASP web cross-check.
Hard rules
- Read-only — never apply fixes, commits, or patches.
- Never review without reading full files — hunks lie.
- Report only high-confidence findings (see
references/confidence-rubric.md).
- Zero findings is a valid result; report it confidently with Non-findings considered and Out of scope sections.
1---2name: verasic-secbot3description: STRIDE security review on git diff with optional deterministic scanner. Use when the user asks to "security review", "review for security", "STRIDE review", "check my diff for vulnerabilities", or before commit/PR when auth, crypto, webhooks, or untrusted input changed.4---56Security: see `references/scanner-notes.md` and upstream [SECURITY.md](https://github.com/Milkywayrules/verasic-skills/blob/main/SECURITY.md) for expected scanner signals and trust model.78# Verasic Secbot — Orchestration910## Workflow11121. Determine scope from the user's message: branch changes (default) or overrides (`uncommitted only`, `staged only`, `against <branch>`). Invoke phrase beats defaults when both set.132. Resolve run settings from invoke-phrase overrides first, then inlined defaults in `references/config-schema.md`:1415| Setting | Default |16| --- | --- |17| `scanner` | `off` |18| `strictness` | `strict` |19| `report.write` | `true` |20| `report.promote` | `both` |21| `trackedDir` | `verasic` |22| `localDir` | `.verasic` |2324Invoke-phrase overrides: scope flags, `strict` / `assertive`, `no file`, `save tracked`, scanner override (`off` / `opengrep` / `semgrep` / `auto`).253. Optional scanner: when `scanner` is not `off`, run `scripts/run-scanner.sh <scanner> --` on changed source paths only (see `references/scanner-adapter.md`). Scanner missing → one-line skip, continue.264. In Cursor: launch the `verasic-secbot-reviewer` subagent (`.cursor/agents/verasic-secbot-reviewer.md`) with repository path, scope, scanner results (if any), and resolved settings — in the **foreground**. Relay its report unchanged **except** strip harness paths, skill/rule names, protocol dumps, and internal config per `verasic-agent-disclosure`.275. In any agent without subagents: read `references/security-review-protocol.md` and execute the review yourself in this conversation, following it exactly.286. After relay: if the diff has no security surface (pure refactor, docs-only, styling), add one cross-tip line to `/verasic-bugbot` for general bug hunting. Never auto-chain.2930## Orchestration (Cursor)3132Run a STRIDE-focused security review of local changes.33341. Resolve run settings from invoke-phrase overrides first, then inlined defaults in `references/config-schema.md` — do **not** read verasic.config.ts, .verasicrc.json, or .verasicrc.jsonc (no repo config skill in v0.2.0).352. When resolved `scanner` is not `off`, run `.cursor/skills/verasic-secbot/scripts/run-scanner.sh <scanner> --` (or `.agents/skills/verasic-secbot/scripts/run-scanner.sh` for cursor-hybrid installs) on changed paths per `references/scanner-adapter.md` before the LLM pass.363. Launch the `verasic-secbot-reviewer` subagent in the foreground with:3738```text39Full Repository Path: <current workspace root>40Diff: branch changes (use uncommitted changes if I said so in my message)41Strictness: strict (use assertive if I said so)42Follow security-review-protocol.md fully: STRIDE, OWASP web checks, confidence legend, merge scanner + LLM findings, write artifacts per inlined defaults.43```44454. Relay the subagent report verbatim — do not soften severities. Strip harness internals per verasic-agent-disclosure.465. If zero findings, say so plainly. Append one cross-tip line to `/verasic-bugbot` only when the diff had no security-sensitive paths.4748## Source of truth4950The full security review protocol (diff scope, STRIDE + OWASP, filtering, confidence, output, artifacts) lives in `references/security-review-protocol.md`. The Cursor subagent is a thin pointer to it; never duplicate the protocol elsewhere.5152## Checklists5354- `checklists/security.md` — shared with verasic-bugbot; apply on every run alongside STRIDE + OWASP web cross-check.5556## Hard rules5758- **Read-only** — never apply fixes, commits, or patches.59- Never review without reading full files — hunks lie.60- Report only high-confidence findings (see `references/confidence-rubric.md`).61- Zero findings is a valid result; report it confidently with Non-findings considered and Out of scope sections.
milkywayrules