marvin8/wuming
Watch
1
0
Fork
You've already forked wuming
 0
Code Issues Pull requests Releases 9 Activity Actions

Phase 6: add SecurityAgent (OWASP Top 10) #16

New issue
Closed
opened 2026-06-11 04:00:41 +00:00 by coding-agent-marvin8 · 1 comment
coding-agent-marvin8 commented 2026-06-11 04:00:41 +00:00 (Migrated from codeberg.org)
Copy link

Add a dedicated security agent that reviews code, config, and shell files for OWASP Top 10 vulnerabilities (injection, broken auth, sensitive data exposure, misconfiguration, vulnerable components, etc.). Register it in AGENT_REGISTRY and add it to the run-wuming.fish defaults.

Add a dedicated security agent that reviews code, config, and shell files for OWASP Top 10 vulnerabilities (injection, broken auth, sensitive data exposure, misconfiguration, vulnerable components, etc.). Register it in AGENT_REGISTRY and add it to the run-wuming.fish defaults.
coding-agent-marvin8 commented 2026-06-11 04:01:02 +00:00 (Migrated from codeberg.org)
Copy link

Exploration findings and plan of attack:

Key files:

  • src/wuming/agents/security.py (new) — SecurityAgent subclassing BaseAgent
  • src/wuming/router.py — add import + registry entry
  • run-wuming.fish — add security to default agents
  • ROADMAP.md, CLAUDE.md, README.md — docs update

Approach:
The existing agents all follow the same pattern: a BaseAgent subclass with name, file_patterns (tuple), and system_prompt class vars. The security agent covers a union of code, config, and shell file patterns — all three are attack surfaces.

System prompt covers all OWASP Top 10 (2021): A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable & Outdated Components, A07 Identification & Authentication Failures, A08 Software & Data Integrity Failures, A09 Security Logging & Monitoring Failures, A10 SSRF.

Sequence:

  1. Failing tests in tests/test_agents.py and tests/test_router.py
  2. Implement security.py + register in router.py
  3. Update run-wuming.fish defaults
  4. Update README, CLAUDE.md, ROADMAP.md
Exploration findings and plan of attack: **Key files:** - `src/wuming/agents/security.py` (new) — SecurityAgent subclassing BaseAgent - `src/wuming/router.py` — add import + registry entry - `run-wuming.fish` — add `security` to default agents - `ROADMAP.md`, `CLAUDE.md`, `README.md` — docs update **Approach:** The existing agents all follow the same pattern: a BaseAgent subclass with `name`, `file_patterns` (tuple), and `system_prompt` class vars. The security agent covers a union of code, config, and shell file patterns — all three are attack surfaces. **System prompt covers all OWASP Top 10 (2021):** A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable & Outdated Components, A07 Identification & Authentication Failures, A08 Software & Data Integrity Failures, A09 Security Logging & Monitoring Failures, A10 SSRF. **Sequence:** 1. Failing tests in `tests/test_agents.py` and `tests/test_router.py` 2. Implement `security.py` + register in `router.py` 3. Update `run-wuming.fish` defaults 4. Update README, CLAUDE.md, ROADMAP.md
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
pages
feat/issue-57-ci-container-publish
feat/issue-53-review-quality
0.8.0
0.7.0
0.6.2
0.6.1
0.6.0
0.5.0
0.4.0
0.3.2
0.3.1
0.3.0
0.2.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
marvin8/wuming#16
No description provided.