open/voyage
1
0
Fork 0
Code Issues Releases 2 Activity

refactor(agents): relocate example blocks to body (researchers + gemini-bridge)

Browse source
This commit is contained in:
Kjell Tore Guttormsen 2026-06-29 10:14:35 +02:00
commit 816bf2a5fc
5 changed files with 109 additions and 99 deletions
Download patch file Download diff file Expand all files Collapse all files

42
agents/security-researcher.md
View file

@ -3,26 +3,6 @@ name: security-researcher
description: |
Use this agent when the research task requires security investigation of a technology,
dependency, or library — CVEs, audit history, supply chain risks, and OWASP relevance.
<example>
Context: trekresearch is evaluating whether a dependency is safe to adopt
user: "/trekresearch Research whether we should trust the `node-fetch` library"
assistant: "Launching security-researcher to check CVE history, supply chain risk, and audit reports for node-fetch."
<commentary>
Before adopting a dependency, security-researcher checks the attack surface: known
vulnerabilities, maintainer health, and whether past issues were handled responsibly.
</commentary>
</example>
<example>
Context: trekresearch is assessing the security posture of a technology choice
user: "/trekresearch Evaluate the security implications of using JWT for session management"
assistant: "I'll use security-researcher to check known JWT vulnerabilities, OWASP guidance, and community security reports."
<commentary>
Technology choices have security tradeoffs. security-researcher maps the threat surface
using CVE databases, OWASP categories, and verified audit reports.
</commentary>
</example>
model: opus
color: red
tools: ["WebSearch", "WebFetch", "mcp__tavily__tavily_search", "mcp__tavily__tavily_research"]
@ -140,3 +120,25 @@ End with an overall security summary table:
risks from incomplete information.
- **Severity matters.** A CVSS 9.8 is not equivalent to a CVSS 3.2 — report scores
and distinguish between critical and low-severity findings.
## When to use — examples
<example>
Context: trekresearch is evaluating whether a dependency is safe to adopt
user: "/trekresearch Research whether we should trust the `node-fetch` library"
assistant: "Launching security-researcher to check CVE history, supply chain risk, and audit reports for node-fetch."
<commentary>
Before adopting a dependency, security-researcher checks the attack surface: known
vulnerabilities, maintainer health, and whether past issues were handled responsibly.
</commentary>
</example>
<example>
Context: trekresearch is assessing the security posture of a technology choice
user: "/trekresearch Evaluate the security implications of using JWT for session management"
assistant: "I'll use security-researcher to check known JWT vulnerabilities, OWASP guidance, and community security reports."
<commentary>
Technology choices have security tradeoffs. security-researcher maps the threat surface
using CVE databases, OWASP categories, and verified audit reports.
</commentary>
</example>