Security Review¶
CloudAEye checks code changes for security issues in applications, LLM integrations, and AI agents. It also looks for credentials exposed in changed lines. Findings show the affected code, the risk, and suggested fixes.
Prerequisites¶
Connect your repository using Code Review setup, then choose your review settings.
Run in a Pull Request or Merge Request¶
In a connected GitHub or Bitbucket pull request, or a GitLab merge request, comment:
@cloudaeye /security
For bug detection, use full Review Code.
Run from Your Coding Agent¶
Use CloudAEye from your coding agent to review uncommitted changes, changes under a path, or an open pull request:
/cloudaeye:security
/cloudaeye:security src/auth/
/cloudaeye:security #405
To see high and critical findings, add --high:
/cloudaeye:security src/auth/ --high
Supported Security Checks¶
Application Security¶
Review code changes for common OWASP Top 10 vulnerabilities and security misconfigurations. See the Security & Compliance checklist for checks you can run before merging to catch potential security issues early.
| Check | Review Focus |
|---|---|
| Authentication and authorization | Missing login or permission checks, or access beyond the caller's permissions. |
| Injection protection | Untrusted input reaching SQL, NoSQL, or shell commands without safe parameterization or validation. |
| Sensitive data handling | Private data exposed in logs, requests, or responses. |
| Safe deserialization | Untrusted data loaded with unsafe deserialization methods. |
| Security misconfiguration | Overly broad permissions and unsafe security settings. |
| XML External Entity (XXE) | XML parsers that use external references to read local files or make unwanted network requests. |
| Secrets in code | API keys, tokens, passwords, and other credentials exposed on changed lines. |
LLM and Generative AI Security¶
Review LLM-powered features, including chatbots, RAG applications, and content generation, for common generative AI security risks. See the LLM and GenAI Security checklist for checks you can run before merging to identify potential vulnerabilities early.
| Check | Review Focus |
|---|---|
| Prompt injection | User prompts or retrieved content overriding the application's intended instructions. |
| Sensitive information disclosure | Confidential data sent to external models or exposed in generated responses. |
| Improper output handling | Model output passed to other systems without validation or sanitization. |
| System prompt leakage | Internal instructions exposed through application behavior. |
| Vector and embedding weaknesses | Unsafe retrieval data, vector-store isolation, or embedding handling. |
| Misinformation | Misleading model output used for important decisions without checks. |
| Unbounded consumption | Unlimited model calls or resource use that can cause outages or excessive costs. |
AI-Agent Security¶
Review AI agents and autonomous systems that plan, delegate tasks, invoke tools, or take actions on a user's behalf. See the Agentic Security checklist for checks you can run before merging to identify potential security risks early.
| Check | Review Focus |
|---|---|
| Memory poisoning | Untrusted content saved in memory and affecting later agent actions. |
| Tool misuse | Unsafe tool chaining, unintended actions, and inappropriate tool access. |
| Privilege compromise | Agents passing more permissions to other agents than the task needs. |
| Resource overload | Planning or delegation loops consuming compute, storage, or API credits without limits. |
| Cascading hallucination | Incorrect output from one agent leading to unsafe decisions by others. |
| Intent breaking and goal manipulation | External content changing an agent's goals or planning logic. |
| Repudiation and untraceability | Missing logs of who requested an action and what the agent did. |
| Human-in-the-loop overload | Too many approval requests, or important decisions buried among routine ones. |
| Unexpected code execution | Generated code or tool access enabling remote code execution or local system misuse. |
| Rogue agents | Unauthorized or compromised agents entering a multi-agent workflow. |
MCP Server¶
Review Model Context Protocol (MCP) servers that expose tools, resources, and prompts to AI applications. Ensure server definitions are clear, inputs are validated, tool execution is safe, and responses are reliable. See the MCP Server checklist for checks you can run before merging to identify potential security and reliability issues early.
| Check | Review Focus |
|---|---|
| Definition & Documentation | |
| MCP Server Metadata | Server has a clear, descriptive name and purpose that helps users understand its functionality. |
| Tool Definitions | Each tool clearly describes its purpose, intended use, and behavior. |
| Resource Definitions | Resources document their purpose, content, and returned data format. |
| Prompt Definitions | Reusable prompts specify their purpose, required inputs, and expected behavior. |
| Parameter Descriptions | Every input parameter documents valid values, expected formats, and constraints. |
| Internal vs. Client Descriptions | Documentation focuses on how to use features rather than exposing unnecessary implementation details. |
| Naming Conventions | Tools, resources, and prompts use consistent, descriptive names that communicate their purpose. |
| Tool Parameter Handling | |
| Type Annotations | Input parameters specify appropriate data types, including strings, numbers, arrays, and structured objects. |
| Optional vs. Required Parameters | Required fields, optional fields, and default values are clearly defined and handled correctly. |
| Validation Constraints | Inputs are validated for type, format, allowed values, and safe boundaries before processing. |
| Hidden Parameters | API keys, credentials, and other sensitive values are injected securely rather than exposed as ordinary user inputs. |
| Complex Types | Complex inputs use well-defined schemas and structured types instead of ambiguous generic formats. |
| Tool Call Return Optimization | |
| Async vs. Sync Execution | Long-running operations, network requests, and file operations use appropriate asynchronous or synchronous execution patterns. |
| Return Type Validation | Tool outputs conform to consistent, validated schemas and expected return types. |
| Content Formatting | Text, images, and structured data are returned using appropriate content formats. |
| Response Size Management | Large results support pagination, filtering, or other limits to prevent oversized responses. |
| Streaming Responses | Large outputs or exports support incremental delivery when appropriate. |
| Error Handling | |
| Error Handling | Errors provide clear, actionable messages without exposing sensitive implementation details. |
| Internal Detail Masking | Detailed diagnostic information is logged securely while user-facing errors avoid leaking stack traces, secrets, or internal system details. |
| Graceful Degradation | Failures in optional features do not unnecessarily disrupt unrelated server functionality. |
| Timeout Handling | External operations have appropriate timeouts and return clear errors when execution exceeds configured limits. |
| Autonomous Tool Interactions | |
| Tool Safety | Destructive operations, such as deleting resources or modifying data, are clearly identified and protected by appropriate confirmation mechanisms. |
| Tool Availability | Tools are enabled or disabled appropriately based on the availability of required services and dependencies. |
| Tool Dependencies | Dependencies between tools and external services are clearly defined and handled safely. |
| Rate Limiting | Requests are limited appropriately to prevent abuse and excessive consumption of backend resources. |
| Idempotency | Operations that may be retried safely are designed to avoid unintended duplicate side effects. |
| Sampling and Elicitation | |
| Prompt Injection Protection | Untrusted user input and external content are separated from trusted instructions and handled to reduce prompt injection risks. |
| LLM Response Validation | Responses generated by AI models are validated against expected schemas, formats, and constraints before use. |
| Client Authenticity | Responses received from MCP clients are validated rather than blindly trusted. |
| Elicitation Patterns | Complex user requirements are collected through clear, structured, step-by-step interactions. |
| Context Management | Conversation history and contextual data are managed appropriately to preserve relevance and minimize unnecessary exposure of sensitive information. |
| Destructive Operation Elicitation | Destructive actions require explicit user confirmation when appropriate, including when elicitation is used to obtain authorization. |
Secret Detection¶
Review credentials exposed in changed lines. For a real leaked credential, revoke or rotate it, then remove it from code.
Coding-agent reviews scan edited files with Gitleaks and check hits on changed lines. A regex scanner is used if Gitleaks is unavailable. A model then checks whether hits look like real credentials or test values.
Credential values are redacted from scanner metadata. The model also receives the code diff, which can still contain them.
PR and merge-request reviews use the review service's configured secret scanner.
Use Cases¶
| Use Case | What to Review |
|---|---|
| Identify web application vulnerabilities | Check access control, injection, authentication, data exposure, and security settings before deployment. |
| Secure LLM-powered applications | Review prompts, retrieved content, model outputs, and tool permissions. |
| Secure AI agents and autonomous workflows | Check planning, delegated permissions, memory, tool use, and external actions. |
| Prevent prompt injection and tool abuse | Trace where untrusted content can influence model behavior or trigger tool calls. |
| Protect sensitive data and credentials | Find exposed credentials and ways private data could leak through application code or AI workflows. |
| Enforce security standards during code review | Combine focused reviews with configured automatic PR reviews and shared checklist policies. |
| Review AI-generated code for security risks | Apply the same checks to AI-written changes, especially model integrations, agents, and external tools. |
| Reduce later remediation work | Find and fix issues while the code change is still fresh. |
| Establish consistent reviews across teams | Use shared security checks and settings across repositories. |
Read and Act on Findings¶
Use each finding's location, explanation, and suggested fix to update the code. Test both allowed and blocked behavior.
For local coding-agent reviews, use the finding numbers with /cloudaeye:implement to get a fix plan. See the usage guide for the steps.
Use PR Checklist to configure security policies, and Auto PR Review to include security in your everyday review workflow.