marvin8/wuming

Watch

Fork 0

Add SecurityAgent for OWASP Top 10 code review #17

Merged

coding-agent-marvin8 merged 0 commits from refs/pull/17/head into main

2026-06-11 04:46:13 +00:00

coding-agent-marvin8 commented

2026-06-11 04:07:03 +00:00

(Migrated from codeberg.org)

Adds a dedicated security reviewer that runs alongside the existing agents, looking at the same files through an OWASP Top 10 (2021) lens.

Changes

src/wuming/agents/security.py — new SecurityAgent covering all 10 OWASP categories (A01–A10) across code, config, and shell file types
src/wuming/router.py — registered SecurityAgent in AGENT_REGISTRY
run-wuming.fish — added security to the default agents list (code,docs,security)
Tests: 9 new tests in test_agents.py, 1 new test in test_router.py; all 202 tests pass
README.md, CLAUDE.md, ROADMAP.md updated for Phase 6 completion

Closes #16

Adds a dedicated security reviewer that runs alongside the existing agents, looking at the same files through an OWASP Top 10 (2021) lens. ## Changes - `src/wuming/agents/security.py` — new `SecurityAgent` covering all 10 OWASP categories (A01–A10) across code, config, and shell file types - `src/wuming/router.py` — registered `SecurityAgent` in `AGENT_REGISTRY` - `run-wuming.fish` — added `security` to the default agents list (`code,docs,security`) - Tests: 9 new tests in `test_agents.py`, 1 new test in `test_router.py`; all 202 tests pass - `README.md`, `CLAUDE.md`, `ROADMAP.md` updated for Phase 6 completion Closes #16

coding-agent-marvin8 commented

2026-06-11 04:41:22 +00:00

(Migrated from codeberg.org)

src/wuming/agents/security.py line 38 — @marvin8

The system prompt includes instructions about line number annotations (lines 72–74) and JSON response format (lines 76–85)...

🔴 Not actioning. The format instructions in the system prompt are intentional — they tell the LLM how to read the annotated diff and what JSON schema to produce. This is the same pattern used in CodeAgent, ShellAgent, and every other agent in the codebase. The parsing logic in BaseAgent.review() consumes the output; the LLM needs to know the schema before it writes the response, so the prompt is the correct place for these instructions.

[`src/wuming/agents/security.py` line 38](https://codeberg.org/marvin8/wuming/pulls/17#issuecomment-17253506) — @marvin8 > The system prompt includes instructions about line number annotations (lines 72–74) and JSON response format (lines 76–85)... 🔴 Not actioning. The format instructions in the system prompt are intentional — they tell the LLM how to read the annotated diff and what JSON schema to produce. This is the same pattern used in `CodeAgent`, `ShellAgent`, and every other agent in the codebase. The parsing logic in `BaseAgent.review()` consumes the output; the LLM needs to know the schema *before* it writes the response, so the prompt is the correct place for these instructions.

coding-agent-marvin8 commented

2026-06-11 04:42:50 +00:00

(Migrated from codeberg.org)

src/wuming/agents/security.py line 88 — @marvin8

The SecurityAgent class inherits from BaseAgent but does not explicitly call super().init()...

🔴 Not actioning. SecurityAgent does not define its own __init__, so Python MRO delegates directly to BaseAgent.__init__ when you call SecurityAgent(model=...). An explicit super().__init__() is only needed when the subclass overrides __init__. This is identical to CodeAgent, DocsAgent, ShellAgent, and ConfigAgent — none of them define __init__ either, and all pass their test suite.

[`src/wuming/agents/security.py` line 88](https://codeberg.org/marvin8/wuming/pulls/17#issuecomment-17253509) — @marvin8 > The SecurityAgent class inherits from BaseAgent but does not explicitly call super().__init__()... 🔴 Not actioning. `SecurityAgent` does not define its own `__init__`, so Python MRO delegates directly to `BaseAgent.__init__` when you call `SecurityAgent(model=...)`. An explicit `super().__init__()` is only needed when the subclass *overrides* `__init__`. This is identical to `CodeAgent`, `DocsAgent`, `ShellAgent`, and `ConfigAgent` — none of them define `__init__` either, and all pass their test suite.

coding-agent-marvin8 commented

2026-06-11 04:43:01 +00:00

(Migrated from codeberg.org)

tests/test_agents.py line 370 — @marvin8

Import is placed inside the test file after other imports and test definitions... should be moved to the top of the file.

✅ Fixed in commit 2c2b079 — SecurityAgent import moved to the top of test_agents.py alongside the other agent imports; # noqa: E402 comment removed.

[`tests/test_agents.py` line 370](https://codeberg.org/marvin8/wuming/pulls/17#issuecomment-17253512) — @marvin8 > Import is placed inside the test file after other imports and test definitions... should be moved to the top of the file. ✅ Fixed in commit `2c2b079` — `SecurityAgent` import moved to the top of `test_agents.py` alongside the other agent imports; `# noqa: E402` comment removed.

coding-agent-marvin8 commented

2026-06-11 04:43:12 +00:00

(Migrated from codeberg.org)

tests/test_agents.py line 398 — @marvin8

Test "test_security_agent_review_no_match" does not verify that the backend was not called...

✅ Fixed in commit 2c2b079 — added call_count: int = 0 to _FakeBackend (incremented on each complete() call) and added expect(backend.call_count).to_equal(0) to test_security_agent_review_no_match.

[`tests/test_agents.py` line 398](https://codeberg.org/marvin8/wuming/pulls/17#issuecomment-17253515) — @marvin8 > Test "test_security_agent_review_no_match" does not verify that the backend was not called... ✅ Fixed in commit `2c2b079` — added `call_count: int = 0` to `_FakeBackend` (incremented on each `complete()` call) and added `expect(backend.call_count).to_equal(0)` to `test_security_agent_review_no_match`.

coding-agent-marvin8 commented

2026-06-11 04:43:25 +00:00

(Migrated from codeberg.org)

CLAUDE.md line 47 — @marvin8

Typo: "wuming.config" should likely be "wuming.config"...

🔴 Not actioning. The note is accurate: wuming.config refers to the real module at src/wuming/config.py (importable as wuming.config). The comment explains why the agents config file is config_agent.py rather than config.py — if it were named config.py it would live at wuming.agents.config, which does not shadow wuming.config, but historically caused import confusion. The quoted text is correct as written.

[`CLAUDE.md` line 47](https://codeberg.org/marvin8/wuming/pulls/17#issuecomment-17253518) — @marvin8 > Typo: "wuming.config" should likely be "wuming.config"... 🔴 Not actioning. The note is accurate: `wuming.config` refers to the real module at `src/wuming/config.py` (importable as `wuming.config`). The comment explains why the agents config file is `config_agent.py` rather than `config.py` — if it were named `config.py` it would live at `wuming.agents.config`, which does not shadow `wuming.config`, but historically caused import confusion. The quoted text is correct as written.

No reviewers

No labels

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

marvin8/wuming!17

No description provided.

Rows
Columns