44seclab-taskflow-agent :
55 filetype : taskflow
66 version : " 1.0"
7- model_config : seclab_taskflows.configs.model_config_github_models
8-
9- # Required: pass the target repository on the command line, e.g.
10- # --global repo_nwo=has-ghas/juice-shop
11- # An empty default produces a silently broken run (the audit personality
12- # will be asked to analyse no repository).
13- globals :
14- repo_nwo :
157# Taskflow to analyze the access control checks of endpoints in a JavaScript or TypeScript web project.
168# It uses a CodeQL database for the analysis. (specified by the repo_nwo input)
179taskflow :
@@ -25,12 +17,12 @@ taskflow:
2517 toolboxes :
2618 - seclab_taskflow_agent.toolboxes.memcache
2719 - task :
28- model : code_analysis
20+ model : claude-sonnet-4
2921 must_complete : false
3022 agents :
3123 - seclab_taskflows.personalities.web_application_security_expert
3224 inputs :
33- repo_nwo : " {{ globals.repo_nwo }} "
25+ repo_nwo :
3426 user_prompt : |
3527 Fetch CodeQL database for the {{ inputs.repo_nwo }} repository for the
3628 JavaScript language. Prefer the local CodeQL Development MCP server: call
@@ -44,7 +36,7 @@ taskflow:
4436 This database is built for a JavaScript web project.
4537
4638 ## IMPORTANT: Vulnerability Pattern Details
47-
39+
4840 Review the files specifying routes and endpoints for the security vulnerabilities
4941 described as follows:
5042
@@ -68,7 +60,7 @@ taskflow:
6860
6961 1. Do NOT ask the user for permission to perform next steps, continue your
7062 analysis autonomously until it is complete.
71-
63+
7264 2. Reflect on your analysis for accuracy before returning it to the user.
7365 We are only interested in results that you can clearly explain and
7466 motivate as potentially vulnerable based on code examples.
0 commit comments