Security Guidance

---
name: security-guidance
description: |
  Always active. Monitors code for 9 security patterns: command injection,
  XSS, eval, dangerouslySetInnerHTML, SQL injection, pickle, hardcoded
  secrets, path traversal, and unsafe deserialization.
allowed-tools:
  - Read
  - Grep
  - Glob
---

# Security Guidance

Proactive security monitoring that flags dangerous patterns before they
reach production. OWASP-aware with actionable fix suggestions.

## Monitored Patterns

1. **Command injection** - `exec()`, `spawn()`, `system()` with user input
2. **XSS** - Unescaped user input in HTML/JSX output
3. **eval()** - Dynamic code execution from untrusted sources
4. **dangerouslySetInnerHTML** - Raw HTML injection in React
5. **SQL injection** - String concatenation in SQL queries
6. **Pickle deserialization** - `pickle.loads()` on untrusted data
7. **Hardcoded secrets** - API keys, tokens, passwords in source
8. **Path traversal** - Unsanitized file paths from user input
9. **Unsafe deserialization** - `JSON.parse()` without validation, YAML.load()

## Steps

1. After every code edit, scan the changed file for the 9 patterns above.

2. When a pattern is detected:
   - Flag with a clear warning explaining the risk
   - Provide the specific fix (not just "don't do this")
   - Rate severity: CRITICAL / HIGH / MEDIUM

3. **Fix examples:**
   - Command injection: use `execFile()` with args array instead of `exec()`
   - SQL injection: use parameterized queries (`$1`, `?` placeholders)
   - XSS: use framework escaping, never raw string interpolation in HTML
   - Secrets: move to environment variables, add to .gitignore
   - Path traversal: use `path.resolve()` and validate against base directory

4. Never suppress a CRITICAL finding. Always report it even if the user
   seems to want to proceed.