micro--go-micro
Asim Aslam
ab0bf29c79
Adds an opt-in `security` role to `micro loop` and wires it into go-micro's own loop. On a schedule it dispatches the agent to audit the codebase for real, exploitable vulnerabilities and file them. Security gets a deliberately more conservative policy than the other roles, encoded in .github/loop/prompts/security.md: - NEVER auto-merges a security change (fixes stay human-reviewed). - NEVER publishes exploit detail / PoC in a public issue — novel exploitable findings get a concise `security` + `needs-human` issue (class, location, impact) routed to private disclosure; only known/public dep CVEs get a bump PR (no auto-merge). - Weekly by default (`--security-cron`, 0 6 * * 1); tunable. The go-micro prompt targets its real attack surface: MCP/A2A gateways, x402 payments, JWT/wrapper auth, provider BaseURL SSRF + key leakage, the agent tool loop (prompt injection / guardrail bypass), TLS defaults, the loop's own PAT, and dependency CVEs via govulncheck. Note: an agent review is not a gate. The deterministic companion — govulncheck as a required CI check — is a recommended follow-up so known-vulnerable deps can't merge at all. Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL Co-authored-by: Claude <noreply@anthropic.com>
23 行
2.8 KiB
Cheetah
23 行
2.8 KiB
Cheetah
<!--
|
|
The SECURITY prompt — the editable policy for the security role. The workflow
|
|
prepends the agent @mention and substitutes __ISSUE__ before posting. Keep
|
|
__ISSUE__ literal.
|
|
|
|
Security is deliberately more conservative than the other roles: it does NOT
|
|
auto-merge fixes, and it does NOT publish exploit details in public issues.
|
|
-->
|
|
Act as the security reviewer for this repository. Audit for real, exploitable vulnerabilities — do not pad the report with theoretical or low-value lint-style noise.
|
|
|
|
WHAT TO LOOK FOR: injection (SQL/command/template), authentication and authorization bypass, credential/secret/token exposure (in code, logs, or error messages), SSRF and unsafe outbound requests (especially user- or config-controlled URLs), path traversal, unsafe deserialization, missing or incorrect input validation on trust boundaries (HTTP handlers, RPC endpoints, message consumers), insecure defaults (TLS, auth, permissions), unsafe use of `crypto`/randomness, and known-vulnerable dependencies (run `govulncheck ./...` if available, or inspect `go.mod`).
|
|
|
|
DEDUPE against open issues before filing anything.
|
|
|
|
HOW TO REPORT — this matters:
|
|
- **Known/public dependency CVEs** (already disclosed): file an issue labeled `security` referencing the CVE and the affected module, and you MAY open a PR that bumps the dependency to the patched version. Do **NOT** enable auto-merge — leave it for human review.
|
|
- **Novel, exploitable vulnerabilities in this codebase** (not yet public): do **NOT** post a working exploit, proof-of-concept, or step-by-step reproduction in a public issue — that is irresponsible disclosure. File a CONCISE issue labeled `security` and `needs-human` that names the vulnerability *class*, the *location* (file/function), and the *impact*, with only enough detail for a maintainer to find it — and note it should be handled via the repository's private vulnerability reporting if the repo is public. Do NOT open a public fix PR that reveals the vulnerability; leave the fix to a human.
|
|
- **Low-risk hardening** (defense-in-depth, missing validation with no proven exploit): a normal `security` issue is fine.
|
|
|
|
NEVER auto-merge a security change. Never weaken a control to make a test pass. Anything requiring an architectural or breaking change: label it `needs-human` and describe the tradeoff.
|
|
|
|
Post a summary as a comment on this issue (#__ISSUE__) — how many findings by severity, what you filed, and what needs a human — then close it (`gh issue close __ISSUE__`). If you open a dependency-bump PR, do it yourself from the shell: `git switch -c loop/security-__ISSUE__`, `git push -u origin loop/security-__ISSUE__`, `gh pr create --base << .DefaultBranch >> --title "<title>" --body "<summary, Closes #__ISSUE__>"` — then STOP; do NOT run `gh pr merge --auto`. Do not use a make_pr tool.
|