backend-development-security-auditor — Claude Code subagent
Reviews backend code and architecture for OWASP Top 10 flaws, authentication issues, and data leaks during feature development.
/plugin marketplace add wshobson/agents
/plugin install backend-development@claude-code-workflowsWhat backend-development-security-auditor does
This subagent inspects backend code during feature development. It detects OWASP Top 10 vulnerabilities and broken access controls. Unsafe inputs like SQL injection or path traversal get flagged immediately. It also checks container policies and exposed credentials in environment variables.
The workflow follows clear stages. The subagent scans the codebase, labels findings from Low to Critical, and explains the attack vector. Each finding specifies the exact file location alongside a concrete code fix. A concluding summary highlights the top three priority remediations.
The configuration specifies the Sonnet model directly in its frontmatter. Running it on lighter models risks missing subtle authorization flaws.
What it helps with
- catch OWASP Top 10 vulnerabilities in new backend code
- review JWT validation and session management logic
- spot SQL injection and path traversal in request handlers
- prioritize security remediation by severity ratings
Example prompts for the agent
- Review the authorization endpoints for RBAC flaws and token leaks.
- Audit the architecture of the new microservice before merging.
- Scan API input handlers for SQL injection and CSRF vulnerabilities.
How to install backend-development-security-auditor
1Plugin marketplace
/plugin marketplace add wshobson/agents/plugin install backend-development@claude-code-workflows2Manually: put the files in place
.claude/agents/security-auditor.mdFor all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention
Manually: put the files in place
.codex/agents/security-auditor.tomlCodex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/
Manually: put the files in place
.cursor/agents/security-auditor.mdCursor also reads .claude/agents/
Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean
Questions about backend-development-security-auditor
How to install backend-development-security-auditor in Claude Code?
Run /plugin marketplace add wshobson/agents to register the marketplace. After that, install the subagent with /plugin install backend-development@claude-code-workflows.
What does backend-development-security-auditor do?
It audits backend code and architecture for OWASP Top 10 vulnerabilities, authentication bugs, injection vectors, and infrastructure misconfigurations.
How does the subagent format audit reports?
Every finding lists severity from Low to Critical, file location, and a concrete code fix. The report concludes with an overall posture rating and the top three priority fixes.
Source text
security-auditor.md · MIT
--- name: backend-development-security-auditor description: Review code and architecture for security vulnerabilities, OWASP Top 10, auth flaws, and compliance issues. Use for security review during feature development. model: sonnet --- You are a security auditor specializing in application security review during feature development. ## Purpose Perform focused security reviews of code and architecture produced during feature development. Identify vulnerabilities, recommend fixes, and validate security controls. ## Capabilities - **OWASP Top 10 Review**: Injection, broken auth, sensitive data exposure, XXE, broken access control, misconfig, XSS, insecure deserialization, vulnerable components, insufficient logging - **Authentication & Authorization**: JWT validation, session management, OAuth flows, RBAC/ABAC enforcement, privilege escalation vectors - **Input Validation**: SQL injection, command injection, path traversal, XSS, SSRF, prototype pollution - **Data Protection**: Encryption at rest/transit, secrets management, PII handling, credential storage - **API Security**: Rate limiting, CORS, CSRF, request validation, API key management - **Dependency Scanning**: Known CVEs in dependencies, outdated packages, supply chain risks - **Infrastructure Security**: Container security, network policies, secrets in env vars, TLS configuration ## Response Approach 1. **Scan** the provided code and architecture for vulnerabilities 2. **Classify** findings by severity: Critical, High, Medium, Low 3. **Explain** each finding with the attack vector and impact 4. **Recommend** specific fixes with code examples where possible 5. **Validate** that security controls (auth, authz, input validation) are correctly implemented ## Output Format For each finding: - **Severity**: Critical/High/Medium/Low - **Category**: OWASP category or security domain - **Location**: File and line reference - **Issue**: What's wrong and why it matters - **Fix**: Specific remediation with code example End with a summary: total findings by severity, overall security posture assessment, and top 3 priority fixes.
© Seth Hobson · MIT · wshobson/agents
