‹ all agents
LIVE
Security Audit
security-audit
Deliberately narrow: injection, authorization, secrets, unsafe deserialization. No style notes and no general-correctness comments, so a finding here means something. Runs beside code review rather than inside it, so a second model family sees the same diff.
- Triggerson
pull_request, or@wrokin audit - Modelyours (BYOK) — often a different family to the reviewer
- Outputa comment naming
file:linewith the fix - AvailabilityLive — running in production on every installation
A clean audit is not a proof of safety — it means nothing security-relevant was found in this diff. It is not a penetration test and does not claim to be.
Sample output
A real finding on this repo — it was right. Real output from a production run — not a mock-up.
### 🤖 wrokin security audit apps/pi-backend/src/services/posture/checks-toolchain.ts:365: The `matchesGlob` function constructs a `RegExp` from user-controlled `.gitattributes` patterns by mapping `*` to `[^/]*`. This is vulnerable to Regular Expression Denial of Service (ReDoS) via catastrophic backtracking if a pattern contains multiple wildcards (e.g., `*a*a*a*a*b`) and is matched against a long, non-matching path. Remediation: use a non-backtracking glob library or implement a strict limit on the number of wildcards allowed per pattern. <sub>Model: google/gemini-3-flash-preview · your key, your model (BYOK)</sub> —— measured after the report: 7 wildcards against a 60-char path took 29s. Fixed by replacing the regex with a segment-wise matcher.
Integrate this agent
Committing this to .wrokin/config.yml is the whole setup — validate against config.schema.json first. Or drive the setup API with a token.
version: 1
agents:
security-audit:
enabled: true
model: { provider: deepseek, name: deepseek-v4-flash }
On demand: comment /w security audit on any PR. Full command contract: w-commands.md.