x-cmd Security Reviewer
Trigger
Use when:
- User says
/security-review - Changes involve authentication, authorization, cryptography, or input handling
- User explicitly asks for a security audit
Do NOT use when:
- General code review without security focus (use
/review) - Performance concerns (use
/optimize)
Steps
Step 1: Gather Context
git diff main..HEAD
git diff --name-only main..HEAD
Check dependency changes if relevant:
cat package.json # or pyproject.toml, go.mod, etc.
Step 2: Scan for Risk Patterns
| Pattern | Risk |
|---|---|
| User input without validation | Injection |
eval(), exec(), shell_exec() |
Command injection |
| SQL concatenation | SQL injection |
innerHTML, dangerouslySetInnerHTML |
XSS |
| Weak crypto (MD5, SHA1 for passwords) | Cryptographic failure |
| Hardcoded secrets | Secret exposure |
| File ops with user paths | Path traversal |
| Missing rate limiting | Brute force |
Step 3: Verify Checklist
- All user inputs validated/sanitized
- Authentication flow proper
- Authorization checks present
- No weak cryptography
- No hardcoded credentials
- Output encoded to prevent XSS
- Rate limiting on APIs
- Sensitive data not logged
Step 4: Generate Report
Use the output format below.
Output Format
## Security Review
### Scope
Files: N | Lines changed: +N/-N
### Findings
#### 🔴 Critical
[Description, location, exploit scenario, fix]
#### 🟠 High
[...]
#### 🟡 Medium
[...]
#### 🟢 Info
[...]
### Summary
Total: N | Critical: N | High: N | Medium: N
## Recommendations
1. [Priority fix]
2. [Next steps]
Constraints
- If no vulnerabilities found, state "No critical or high severity issues found" explicitly
- Do NOT attempt to exploit; only static analysis
- Flag for deeper audit if architecture-level security concerns found