security_review
Scan code for injection, XSS, secrets, CORS issues, and insecure comparisons. Get severity-graded findings without LLM. Suppress false positives via .ai-patterns.json.
Instructions
Scan for security patterns: injection (eval/exec/spawn/SQL/template), XSS, secrets, CORS*, insecure compare. Severity-graded, zero LLM. Suppress via malong-ignore or .ai-patterns.json. Out of scope: SSRF/XXE/deserialization/auth.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file | No | File path relative to workspace_dir to scan (reads from disk) | |
| scope | No | Directory relative to workspace_dir to scan recursively (default: none, single file only). scope wins over file/source if both passed | |
| source | No | Source code text to scan (mutually exclusive with file) | |
| max_findings | No | Max findings per file to return (default: 50) | |
| workspace_dir | Yes | REQUIRED: absolute path of the project root to scan |