odin-security

Use when the user requests a userspace C or C++ security review with an explicit threat model, severity filter, and model. Runs a partitioned read-only audit and writes report, SARIF, and findings to a .c-review-results run directory. Not for kernel drivers, managed languages, or embedded code.

Use when building or reusing a CodeQL database, running CodeQL security analysis, or modeling project-specific sources and sinks. Produces a quality-gated database, nonzero query suite, and final SARIF. Not for manual vulnerability review — use confirmed-security-review.

Use when the user asks for a security review, vulnerability audit, or review of injection, XSS, auth, or crypto. Returns only HIGH-confidence vulnerabilities with attacker-controlled input confirmed, or a cleared report. Not for CodeQL analysis — use codeql-security-analysis.

Use when reviewing Django or DRF access control, IDOR, authorization, permissions, or tenant isolation. Returns validated findings with evidence, impact, and enforcing fixes. Not for Django query performance — use django-perf-review. No source or remote-system changes.

Use when mapping state-changing external entry points in a smart-contract codebase by access level. Returns signatures, access classification, restriction evidence, and callbacks. A human-invoked entry-points command with an optional directory is a supported invocation form.

Use when an authorized user needs to assess mobile-backend exposure from compiled Android APKs. Extracts backend configuration from APK carriers, probes discovered endpoints for misconfiguration under written authorization, and returns a per-APK classification with evidence and verified cleanup. Covers Firebase, custom HTTP backends, and cloud function endpoints. Human-only invocation.

Use when an orchestrator or user requests deep audit-context analysis of one function, or needs to build audit context across a codebase before vulnerability hunting. Produces fixed-format per-function prose analysis with cited lines, or a multi-function dossier with entry points, actors, state, and open questions. Not for vulnerability finding or severity rating. Local write only.

Use when asked to review GitHub Actions workflows for exploitable vulnerabilities, including prompt injection through AI coding actions (Claude Code Action, Gemini CLI, OpenAI Codex). Returns HIGH or MEDIUM findings each with a five-element exploitation scenario, or a cleared report. Not for general security review. Read-only.

Use when the user asks to audit a file, subtree, or repository for fallback secrets, default credentials, fail-open controls, weak primitives, permissive access, or exposed debug behavior. Returns a coverage-aware findings report. Not for exhaustive secret scanning.

Use when the user requests a security or correctness audit of a Rust crate, service, library, or subtree, especially unsafe, FFI, concurrency, async, or untrusted-input code. Dispatches cluster-based review workers with dedup and false-positive judging, and writes report.md and findings.sarif. Not for a general security audit. Use security-review.

Use when handling untrusted input, auth/authz, data storage, or external integrations to add security controls during construction. Not for auditing a change set — use security-review. Not for verifying a named finding — use security-finding-verification.

Use when changes touch auth, input parsing, dependencies, network I/O, or pre-release of a public-facing service. Runs a STRIDE walk, OWASP Top 10 walkthrough, and supply-chain scan, and blocks merge on critical or high findings. Not for adding security controls during construction — use security-hardening; not for verifying one named finding — use security-finding-verification.

Use when a user asks for a Semgrep security scan or fast pattern-based scan of a codebase. Runs Semgrep with --sarif, merges results, and reports every finding with severity, file, and line. Not for authoring or porting rules. Use port-static-analysis-rule.

Use when asked to audit a code surface for security-relevant edge cases. Returns a structured findings report. Not for delegated specialist analysis — use sharp-edges-analyzer.

Use when a specialist agent must analyze APIs, configurations, or interfaces for misuse resistance. Returns findings with category, severity, exploitability, and recommendation. Not for a quick inline audit — use sharp-edges.

Use when assessing npm, PyPI, or Go dependency supply-chain risk. Produces deterministic findings.json and report.md with lockfile-aware advisories, three-state coverage, and separate remediation guidance. Handles lockfile-absent paths by marking transitive dependencies unassessable. Do not use for remote or irreversible changes.