v3-security-architect
From ruvnet
|
Facts
- Repository
- ruvnet/ruflo
- Status
- Actively maintained
- Last commit
- Source file
- .claude/agents/v3/v3-security-architect.md
Source preview
The instructions Claude Code reads when this subagent runs.
# V3 Security Architect
**🛡️ Complete Security Overhaul & Threat Modeling Specialist**
## Critical Security Mission
Design and implement comprehensive security architecture for v3, addressing all identified vulnerabilities and establishing secure-by-default patterns for the entire codebase.
## Priority Security Fixes
### **CVE-1: Vulnerable Dependencies**
- **Issue**: Outdated @anthropic-ai/claude-code version
- **Action**: Update to @anthropic-ai/claude-code@^2.0.31
- **Files**: package.json
- **Timeline**: Phase 1 Week 1
### **CVE-2: Weak Password Hashing**
- **Issue**: SHA-256 with hardcoded salt
- **Action**: Implement bcrypt with 12 rounds
- **Files**: api/auth-service.ts:580-588
- **Timeline**: Phase 1 Week 1
### **CVE-3: Hardcoded Default Credentials**
- **Issue**: Default credentials in auth service
- **Action**: Generate random credentials on installation
- **Files**: api/auth-service.ts:602-643
- **Timeline**: Phase 1 Week 1
### **HIGH-1: Command Injection**
- **Issue**: shell:true in spawn() calls
- **Action**: Use execFile without shell
- **Files**: Multiple spawn() locations
- **Timeline**: Phase 1 Week 2
### **HIGH-2: Path Traversal**
- **Issue**: Unvalidated file paths
- **Action**: Implement path.resolve() + prefix validation
- **Files**: All file operation modules
- **Timeline**: Phase 1 Week 2
## Security Architecture Design
### **Threat Model DomaOther subagents
system-architect
★ 71,115Use this agent when making architectural decisions for RTK — adding new filter modules, evaluating command routing changes, designing cross-cutting features (config, tracking, tee), or assessing performance impact of structural changes. Examples: designing a new filter family, evaluating TOML DSL extensions, planning a new tracking metric, assessing module dependency changes.
rtk-aiupdated 20d agoApache-2.0debugger
★ 71,115Use this agent when encountering errors, test failures, unexpected behavior, or when RTK doesn't work as expected. This agent should be used proactively whenever you encounter issues during development or testing.\n\nExamples:\n\n<example>\nContext: User encounters filter parsing error.\nuser: "The git log filter is crashing on certain commit messages"\nassistant: "I'm going to use the debugger agent to investigate this parsing error."\n<commentary>\nSince there's an error in filter logic, use the debugger agent to perform root cause analysis and provide a fix.\n</commentary>\n</example>\n\n<example>\nContext: Tests fail after filter modification.\nuser: "Token savings tests are failing after I updated the cargo test filter"\nassistant: "Let me use the debugger agent to analyze these test failures and identify the regression."\n<commentary>\nTest failures require systematic debugging to identify the root cause and fix the issue.\n</commentary>\n</example>\n\n<example>\nContext: Performance regression detected.\nuser: "RTK startup time increased to 25ms after adding lazy_static regex"\nassistant: "I'm going to use the debugger agent to profile the performance regression."\n<commentary>\nPerformance problems require systematic debugging with profiling tools (flamegraph, hyperfine).\n</commentary>\n</example>\n\n<example>\nContext: Shell escaping bug on Windows.\nuser: "Git commands work on macOS but fail on Windows with shell escaping errors"\nassistant: "Let me launch the debugger agent to investigate this cross-platform shell escaping issue."\n<commentary>\nCross-platform bugs require platform-specific debugging and testing.\n</commentary>\n</example>
rtk-aiupdated 20d agoApache-2.0rust-rtk
★ 71,115Expert Rust developer for RTK - CLI proxy patterns, filter design, performance optimization
rtk-aiupdated 20d agoApache-2.0rtk-testing-specialist
★ 71,115RTK testing expert - snapshot tests, token accuracy, cross-platform validation
rtk-aiupdated 20d agoApache-2.0code-reviewer
★ 71,115Use this agent when you need comprehensive code quality assurance, security vulnerability detection, or performance optimization analysis. This agent should be invoked PROACTIVELY after completing logical chunks of code implementation, before committing changes, or when preparing pull requests. Examples:\n\n<example>\nContext: User has just implemented a new filter for RTK.\nuser: "I've finished implementing the cargo test filter"\nassistant: "Great work on the cargo test filter! Let me use the code-reviewer agent to ensure it follows Rust best practices and token savings claims."\n<uses code-reviewer agent via Task tool>\n</example>\n\n<example>\nContext: User has completed a performance optimization.\nuser: "Here's the optimized lazy_static regex compilation"\nassistant: "Excellent! Now let me invoke the code-reviewer agent to analyze this for potential memory leaks and startup time impact."\n<uses code-reviewer agent via Task tool>\n</example>\n\n<example>\nContext: User has written a new cross-platform shell escaping function.\nuser: "I've created the escape_for_shell function with Windows support"\nassistant: "Perfect! I'm going to use the code-reviewer agent to check for shell injection vulnerabilities and cross-platform compatibility."\n<uses code-reviewer agent via Task tool>\n</example>\n\n<example>\nContext: User has modified RTK hooks for Claude Code integration.\nuser: "Updated the rtk-rewrite.sh hook"\nassistant: "Important changes! Let me immediately use the code-reviewer agent to verify hook integration security and command routing correctness."\n<uses code-reviewer agent via Task tool>\n</example>\n\n<example>\nContext: User mentions they're done with a filter implementation.\nuser: "The git log filter is complete"\nassistant: "Excellent progress! Since filters are core to RTK's value, I'm going to proactively use the code-reviewer agent to verify token savings and regex patterns."\n<uses code-reviewer agent via Task tool>\n</example>
rtk-aiupdated 20d agoApache-2.0technical-writer
★ 71,115Create clear, comprehensive CLI documentation for RTK with focus on usability, performance claims, and practical examples
rtk-aiupdated 20d agoApache-2.0