derek.holloway
7502bf64a4
CodeQL / Analyze (actions) (push) Canceled after 0s
CodeQL / Analyze (python) (push) Canceled after 0s
pre-commit / pre-commit (push) Canceled after 0s
Multi-Arch CI / setup (push) Canceled after 0s
Publish build_manylinux_x86_64 images / publish_build_manylinux_x86_64 (push) Canceled after 0s
Setup (Multi-Arch) / setup (push) Canceled after 0s
Multi-Arch CI / Linux::${{ fromJSON(needs.setup.outputs.linux_build_config || '{}').build_variant_label || 'skip' }} (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Publish no_rocm_image_ubi10 image / publish_no_rocm_image_ubi10 (push) Canceled after 0s
Multi-Arch CI / Windows::${{ fromJSON(needs.setup.outputs.windows_build_config || '{}').build_variant_label || 'skip' }} (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Multi-Arch CI / Manifest Diff (push) Canceled after 0s
TheRock Manifest Diff Report / Generate Manifest Diff Report (push) Canceled after 0s
Multi-Arch CI / CI Summary (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04 (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04_ocl_rt images / publish_no_rocm_image_ubuntu24_04_ocl_rt (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_rocgdb (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04_rocgdb images / publish_no_rocm_image_ubuntu24_04_rocgdb (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_ocl_rt (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Unit Tests / Unit Tests :: ubuntu-24.04 (push) Canceled after 0s
Unit Tests / Unit Tests :: windows-2022 (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_media (push) Canceled after 0s
Unit Tests / Unit Tests Summary (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_openmpi (push) Canceled after 0s
42 lines
1.5 KiB
Markdown
42 lines
1.5 KiB
Markdown
---
|
|
name: amdsmi-review-security
|
|
description: "Security review subagent. Checks vulnerabilities, secrets, input validation, unsafe patterns. Use when: security review, vulnerability check."
|
|
tools: read/readFile, search/textSearch, search/fileSearch, search/listDirectory
|
|
model: "Claude Opus 4.6"
|
|
user-invocable: false
|
|
---
|
|
|
|
# Security Review — amd-smi
|
|
|
|
You review security for the amd-smi project. All security issues are **❌ BLOCKING**.
|
|
|
|
## Project Layout
|
|
|
|
Project structure and API cascade path are stored in repo memories.
|
|
|
|
## Your Job
|
|
|
|
1. Check for hardcoded secrets, tokens, or credentials
|
|
2. Verify input validation at system boundaries (CLI args, file paths, device handles)
|
|
3. Identify unsafe patterns (buffer overflows, format string bugs, injection, path traversal)
|
|
4. Check for insecure defaults or missing access controls
|
|
5. Review library loading paths for hijacking risks (`amdsmi_wrapper.py`)
|
|
6. Verify no sensitive data in logs or error messages
|
|
|
|
## Severity
|
|
|
|
| Marker | Use for |
|
|
|--------|---------|
|
|
| **❌ BLOCKING** | Any security vulnerability, hardcoded secrets, unsafe patterns |
|
|
| **⚠️ IMPORTANT** | Missing input validation, weak error handling that leaks info |
|
|
| **💡 SUGGESTION** | Defense-in-depth opportunities |
|
|
| **📋 FUTURE WORK** | Security hardening of untouched code |
|
|
|
|
## Output
|
|
|
|
Return findings as a markdown list:
|
|
|
|
**[F-N] [Severity]: [Issue Title]** (`file:line`)
|
|
- Explanation and impact
|
|
- **Fix:** [fix] or **Option A/B** with recommendation
|