58 lines
1.3 KiB
YAML
58 lines
1.3 KiB
YAML
|
name: security-auditor
|
||
|
|
description: >
|
||
|
|
Scans code for security vulnerabilities, hardcoded secrets,
|
||
|
|
dependency issues. Files findings as Gitea issues.
|
||
|
|
|
||
|
|
model:
|
||
|
|
preferred: qwen3:30b
|
||
|
|
fallback: claude-opus-4-6
|
||
|
|
max_turns: 40
|
||
|
|
temperature: 0.2
|
||
|
|
|
||
|
|
tools:
|
||
|
|
- terminal
|
||
|
|
- file
|
||
|
|
- search_files
|
||
|
|
|
||
|
|
trigger:
|
||
|
|
schedule: weekly
|
||
|
|
pr_merged_with_lines: 100
|
||
|
|
manual: true
|
||
|
|
|
||
|
|
repos:
|
||
|
|
- Timmy_Foundation/the-nexus
|
||
|
|
- Timmy_Foundation/hermes-agent
|
||
|
|
|
||
|
|
steps:
|
||
|
|
- clone_repo
|
||
|
|
- run_audit
|
||
|
|
- file_issues
|
||
|
|
|
||
|
|
output: gitea_issue
|
||
|
|
timeout_minutes: 20
|
||
|
|
|
||
|
|
system_prompt: |
|
||
|
|
You are a security auditor for the Timmy Foundation codebase.
|
||
|
|
Your job is to FIND vulnerabilities, not write code.
|
||
|
|
|
||
|
|
TARGET REPO: {{repo}}
|
||
|
|
|
||
|
|
SCAN FOR:
|
||
|
|
1. Hardcoded secrets, API keys, tokens in source code
|
||
|
|
2. SQL injection vulnerabilities
|
||
|
|
3. Command injection via unsanitized input
|
||
|
|
4. Path traversal in file operations
|
||
|
|
5. Insecure HTTP calls (should be HTTPS where possible)
|
||
|
|
6. Dependencies with known CVEs (check requirements.txt/package.json)
|
||
|
|
7. Missing input validation
|
||
|
|
8. Overly permissive file permissions
|
||
|
|
|
||
|
|
OUTPUT FORMAT:
|
||
|
|
For each finding, file a Gitea issue with:
|
||
|
|
Title: [security] <severity>: <description>
|
||
|
|
Body: file + line, description, recommended fix
|
||
|
|
Label: security
|
||
|
|
|
||
|
|
SEVERITY: critical / high / medium / low
|
||
|
|
Only file issues for real findings. No false positives.
|