Security Audit

What does Security Audit do?

Scans a public GitHub repo's lockfiles with osv-scanner, judges from the code whether each vulnerable package is actually used, and proposes an upgrade path for each.

What it declines

A task like one of these is declined with a reason, and a declined run is free:

• Upgrading or changing anything: it proposes upgrade paths (Dependency Upgrader applies upgrades).
• Finding new vulnerabilities in the project's own code, or penetration testing.
• Private repositories, or anything that needs credentials.
• Fixing failing tests (CI Fixer does that).

What does a real run of Security Audit look like?

The input, the result (shortened where it is long), how long it took, what it cost and where it ran. Live runs used public or demo material only; a run marked as from the eval suite is not a live run.

This agent needs a sandbox, and ContextStream's Slipstream worker has no sandbox provider yet, so there is no live run to show. The example comes from its eval suite.

{
  "repo_url": "https://github.com/eval/webapp",
  "focus": "the template rendering"
}

# Security audit of https://github.com/eval/webapp

osv-scanner 2.7.0 over 1 lockfile(s).

| Vulnerability | Package | Severity | Verdict | Upgrade |
| --- | --- | --- | --- | --- |
| GHSA-xvch-5gv4-984h | [email protected] (transitive) | critical | uncertain | Upgrade json5, mkdirp to a release that depends on minimist 1.2.6 or later, or override minimist to 1.2.6. |
| GHSA-35jh-r3h4-6jhm | [email protected] (direct) | high | reachable | Upgrade lodash from 4.17.15 to 4.17.21 or later. |
| GHSA-9c47-m6qq-7p4h | [email protected] (dev) | high | not_reachable | Upgrade the dev dependency json5 from 1.0.1 to 1.0.2 or later. |
| GHSA-29mw-wpgm-hmr9 | [email protected] (direct) | medium | not_reachable | Upgrade lodash from 4.17.15 to 4.17.21 or later. |

## GHSA-xvch-5gv4-984h: [email protected]

Prototype Pollution in minimist

**uncertain**: minimist comes in through mkdirp and json5; whether either passes it untrusted arguments is not visible from the project's code.

## GHSA-35jh-r3h4-6jhm: [email protected]

Command Injection in lodash

**reachable**: renderPage compiles the template a site owner saves with _.template, and the server renders it on every request.
- `src/render.js:5`: `const compiled = _.template(templateSource);`

## GHSA-9c47-m6qq-7p4h: [email protected]

Prototype Pollution in JSON5 via Parse Method

**not_reachable**: json5 is a dev dependency used only by the build script, on the repository's own config file.
- `scripts/build-config.js:4`: `const config = JSON5.parse(readFileSync('config.json5', 'utf8'));`

## GHSA-29mw-wpgm-hmr9: [email protected]

Regular Expression Denial of Service (ReDoS) in lodash

**not_reachable**: The project calls only _.template and _.get; it never calls toNumber, trim or trimEnd.
- `src/render.js:1`: `import _ from 'lodash';`

What does Security Audit cost?

Security Audit costs 2,500 ContextStream credits a run, charged only when the run succeeds; a declined, failed, cancelled or timed-out run costs nothing. Credits come with every plan: Starter is free with 10,000 a month (4 runs of Security Audit, if spent on nothing else), and Pro is $19 a month with 25,000.

Which tools does Security Audit work with?

Claude Code, Codex, Cursor and other MCP clients, once ContextStream offers it: through the slipstream tool of ContextStream's MCP, ss run audit in a terminal, or the web app. It needs a sandbox, and ContextStream's Slipstream worker has no sandbox provider yet.

• Claude Code, Codex, Cursor and other MCP clients: connect ContextStream's MCP once (setup for each editor), then ask your agent to hand the job to Security Audit.
• A terminal or an agent's shell: ss run audit, installed with ContextStream's command line.
• The web app: the workspace's specialist library, where each run shows its price before it starts.

What access does Security Audit need?

Security Audit gets a short-lived token for one workspace, limited to 2 scopes: Models via ContextStream and Reads context. It works in one project, and only for that run.

Model agent with a sandbox. A program on ContextStream's model proxy that also drives its own sandbox. The sandbox holds no credentials. Network: github.com, codeload.github.com, objects.githubusercontent.com, release-assets.githubusercontent.com, api.osv.dev, api.deps.dev. It is stopped after 15 min.

How do I turn Security Audit on?

You cannot turn Security Audit on yet: it needs a sandbox, and ContextStream's Slipstream worker has no sandbox provider yet. It is built and tested, and its page shows how it will be called.

How do I call Security Audit from Claude Code or Codex?

Once it is offered: ss run audit in a terminal, or slipstream(action="run", agent="audit", input={...}) over MCP, with the input below.

Connect ContextStream's MCP (it also writes each editor's connection):

curl -fsSL https://contextstream.io/scripts/mcp.sh | bash

Scans every lockfile, judges each vulnerability's reachability and proposes upgrades. Over MCP:

slipstream(action="run", agent="audit", input={"repo_url":"https://github.com/acme/api"}, accepted_price_credits=2500)

In a terminal (curl -fsSL https://contextstream.io/cs/install.sh | sh installs ss):

ss run audit repo_url=https://github.com/acme/api

Over MCP, a call without accepted_price_credits returns the quote first; ss asks on a terminal, and scripts pass --yes.

Input

Related agents

Every Slipstream agent