coverme-security-scanner 3.7.1 → 3.7.2

package/commands/coverme.md

@@ -1,48 +1,36 @@
-# Security Assessment - Automated Scan
+# Security Assessment
 
-Run a comprehensive security assessment on this codebase. Execute ALL steps automatically without asking for confirmation.
+You MUST follow these steps exactly. Do NOT deviate. Do NOT ask questions. Execute automatically.
 
-## Step 1: Setup
-Run this command using Bash:
+## Step 1: Create directory
 ```bash
 mkdir -p .coverme
 ```
 
-## Step 2: Launch 7 Security Agents in Parallel
-Launch ALL 7 agents simultaneously using the Task tool with subagent_type="general-purpose". Do NOT wait between launches - send all 7 in a single response.
+## Step 2: Launch 7 agents IN PARALLEL
 
-**Agent 1 - Executive Summary:**
-Analyze this codebase architecture and security posture. Identify tech stack, components, trust boundaries. Write findings to .coverme/partial-01-executive.json as valid JSON with fields: project (string), date (YYYY-MM-DD), executiveSummary (string), architecture (object with overview string, components array of {name, technology, description}, trustBoundaries array of {id, boundary, trustLevel, description}), topPriorities array of {finding, severity, action}.
+You MUST use the Task tool 7 times in a SINGLE message. Each Task MUST have subagent_type="general-purpose" (NOT Explore).
 
-**Agent 2 - Attack Surface:**
-Map all API endpoints, entry points, unauthenticated routes, admin interfaces. Write to .coverme/partial-02-surface.json as valid JSON with: network (object with diagram string, ports array, externalDeps array of {service, endpoint, auth, risk}), findings array.
+Task 1: description="Security Executive", subagent_type="general-purpose", prompt="Analyze codebase architecture and security posture. Then use the Write tool to create .coverme/partial-01-executive.json with this exact structure: {\"project\":\"<name>\",\"date\":\"2026-02-19\",\"executiveSummary\":\"<summary>\",\"architecture\":{\"overview\":\"<text>\",\"components\":[{\"name\":\"\",\"technology\":\"\",\"description\":\"\"}],\"trustBoundaries\":[{\"id\":\"\",\"boundary\":\"\",\"trustLevel\":\"\",\"description\":\"\"}]},\"topPriorities\":[{\"finding\":\"\",\"severity\":\"\",\"action\":\"\"}]}"
 
-**Agent 3 - Vulnerability Hunter:**
-Hunt for security vulnerabilities: hardcoded secrets, SQL injection, XSS, command injection, auth bypass. Include actual code snippets. Write to .coverme/partial-03-vulns.json as valid JSON with findings array containing: id, title, severity (critical/high/medium/low/info), file, line, issue, why, fix, cwe, codeEvidence array of {file, startLine, endLine, code, annotation}, proofOfConcept.
+Task 2: description="Attack Surface", subagent_type="general-purpose", prompt="Map API endpoints and entry points. Then use the Write tool to create .coverme/partial-02-surface.json with: {\"network\":{\"diagram\":\"\",\"ports\":[],\"externalDeps\":[]},\"findings\":[]}"
 
-**Agent 4 - Attack Chains:**
-Identify how vulnerabilities combine for greater impact. Map attack scenarios. Write to .coverme/partial-04-chains.json as valid JSON with: attackChains array of {id, name, description, likelihood, impact, steps array of {order, findingId, action, outcome}, mitigationStrategy}, riskMatrix array of {category, currentRisk, residualRisk, trend}.
+Task 3: description="Vulnerability Scan", subagent_type="general-purpose", prompt="Find security vulnerabilities with code evidence. Then use the Write tool to create .coverme/partial-03-vulns.json with: {\"findings\":[{\"id\":\"\",\"title\":\"\",\"severity\":\"\",\"file\":\"\",\"line\":0,\"issue\":\"\",\"why\":\"\",\"fix\":\"\",\"cwe\":\"\",\"codeEvidence\":[],\"proofOfConcept\":\"\"}]}"
 
-**Agent 5 - Business Logic:**
-Find business logic flaws: race conditions, workflow bypass, privilege escalation. Write to .coverme/partial-05-business.json as valid JSON with: findings array, threatModel array of {id, severity, dread, status, finding}.
+Task 4: description="Attack Chains", subagent_type="general-purpose", prompt="Identify attack chains. Then use the Write tool to create .coverme/partial-04-chains.json with: {\"attackChains\":[{\"id\":\"\",\"name\":\"\",\"description\":\"\",\"likelihood\":\"\",\"impact\":\"\",\"steps\":[],\"mitigationStrategy\":\"\"}],\"riskMatrix\":[]}"
 
-**Agent 6 - Infrastructure:**
-Check Docker, K8s, CI/CD, secrets management, dependencies. Write to .coverme/partial-06-infra.json as valid JSON with: findings array, qualityReview object with deadCode/dryViolations/deprecated arrays.
+Task 5: description="Business Logic", subagent_type="general-purpose", prompt="Find business logic flaws. Then use the Write tool to create .coverme/partial-05-business.json with: {\"findings\":[],\"threatModel\":[]}"
 
-**Agent 7 - Compliance:**
-Map findings to SOC2, PCI-DSS, GDPR. Identify positive practices. Write to .coverme/partial-07-compliance.json as valid JSON with: complianceMapping array of {framework, controls array}, remediation object with p0/p1/p2/p3 arrays of {action, finding, owner}, positiveObservations array of {title, description}, privacyAnalysis array.
+Task 6: description="Infrastructure", subagent_type="general-purpose", prompt="Check Docker, CI/CD, dependencies. Then use the Write tool to create .coverme/partial-06-infra.json with: {\"findings\":[],\"qualityReview\":{}}"
 
-## Step 3: Wait for All Agents
-After launching all 7 agents, wait for them to complete using AgentOutputTool.
+Task 7: description="Compliance", subagent_type="general-purpose", prompt="Map to compliance frameworks. Then use the Write tool to create .coverme/partial-07-compliance.json with: {\"complianceMapping\":[],\"remediation\":{\"p0\":[],\"p1\":[],\"p2\":[],\"p3\":[]},\"positiveObservations\":[],\"privacyAnalysis\":[]}"
 
-## Step 4: Generate Report
-After all agents complete, run this command using Bash:
+## Step 3: Wait for agents
+Use AgentOutputTool to wait for all 7 agents to complete.
+
+## Step 4: Generate PDF
 ```bash
 coverme-merge .coverme && coverme .coverme/scan.json security-report.pdf && open security-report.pdf
 ```
 
-## IMPORTANT INSTRUCTIONS
-- Execute ALL steps automatically - do not ask for confirmation
-- Launch all 7 agents in PARALLEL (single message with 7 Task tool calls)
-- Wait for ALL agents to complete before running the final command
-- The PDF will open automatically when done
+CRITICAL: Use subagent_type="general-purpose" for ALL agents. They MUST write JSON files using the Write tool.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coverme-security-scanner",
-  "version": "3.7.1",
+  "version": "3.7.2",
   "description": "AI-powered security assessment reports with beautiful PDF output",
   "type": "module",
   "bin": {