agent · built into metaphor
Security reviewer
Application and AI-agent security review, tagged against OWASP. The security reviewer looks for the risks that matter in modern codebases, including the ones introduced by AI agents: prompt injection, unsafe MCP servers, over-broad skills, leaked secrets and vulnerable dependencies. It checks packages against the OSV database and tags real findings with OWASP Top 10, LLM and MCP identifiers.
- Built in
- security
- owasp
- ai safety
you ›Run a security review on this repo
metaphor ›Handing this to Security reviewer. I'll report back when it's done.
you ›Is our MCP setup safe?
you ›Check this PR for injection and secrets
What it does
- Scans code, prompts, skills and MCP configs for agent-specific risks
- Looks up CVEs and GitHub advisories for the dependencies you actually use
- Tags findings with OWASP Top 10, LLM Top 10 and MCP identifiers
- Drafts the report in the Agent Review canvas
Skills it uses
- /ai-securitySkillBudgeted security and AI-agent risk review — ai_security scan, OSV CVE/GHSA lookups, OWASP LLM/MCP/Top10 tagging, draft for Agent Review canvasships with metaphor
- /pr-review-securitySkillSecurity reviewer contract for Agent Review (auth, secrets, permissions, injection, data exposure)ships with metaphor
Questions
What does the Security reviewer agent do?
The security reviewer looks for the risks that matter in modern codebases, including the ones introduced by AI agents: prompt injection, unsafe MCP servers, over-broad skills, leaked secrets and vulnerable dependencies. It checks packages against the OSV database and tags real findings with OWASP Top 10, LLM and MCP identifiers.
How do I start the Security reviewer agent?
It is built into Metaphor. Ask for the work in plain words, for example "Run a security review on this repo", and the main agent hands it off and reports back when it is done.
Can Security reviewer change my code?
Reads code and runs commands only after you approve them. It never edits files.