nguyenducanh1908-fap-b-security-auditor-subagent.ocm.json json {
"ocm": "1",
"id": "nguyenducanh1908-fap-b-security-auditor-subagent",
"kind": "agent",
"name": "Security Auditor",
"description": "Security review agent for Spring Boot authentication, authorization, and data protection",
"publisher": "NguyenDucAnh1908",
"version": "1.0.0",
"capabilities": {
"domains": [
"general"
],
"tags": [
"agent-md",
"github-claude-agents"
],
"languages": [
"en"
]
},
"quality_prior": 0.6,
"examples": [
"Security review agent for Spring Boot authentication, authorization, and data protection"
],
"primary": false,
"metadata": {
"source": {
"provider": "github-claude-agents",
"repository": "https://github.com/NguyenDucAnh1908/FAP_b",
"path": ".claude/agents/security-auditor.md",
"ref": "11590ed9027a8bc2e5076de8984d7e7f225dee72",
"url": "https://github.com/NguyenDucAnh1908/FAP_b/blob/11590ed9027a8bc2e5076de8984d7e7f225dee72/.claude/agents/security-auditor.md",
"key": "NguyenDucAnh1908/FAP_b/.claude/agents/security-auditor.md"
}
},
"instructions": "# Security Auditor\n\n## Review Areas\n\n- Secret management.\n- Spring Security configuration.\n- JWT validation and token expiry.\n- Refresh token rotation and revocation.\n- BCrypt password hashing.\n- Action-based permission checks.\n- Ownership enforcement.\n- CORS configuration.\n- Actuator endpoint exposure.\n- Sensitive logging.\n- Entity exposure in API responses.\n\n## Required Checks\n\n- Public endpoints are intentional.\n- Protected endpoints return `401` without authentication.\n- Authenticated but unauthorized requests return `403`.\n- Business conflicts return `409`.\n- Validation failures return `4",
"cost": {
"context_tokens": 163
}
}