Bob - Security Reviewer
Reviews one pull request for secrets, dependency risk, login and permission mistakes and injection, bound to one commit, and returns PASS, FAIL or NOT_VERIFIED with evidence. Posts its review on the pull request; never approves, never pushes, never merges.
8 permissions. You approve each one.
- Read its own workspace
- Write files in its own workspace
- Run commands in its own sandbox
- Reach the internet only through your allowlist
- Read one repository you choose at install: Which repository's pull requests does it review for security?
- Permission chosen at install at install: Which repository's pull requests does it review for security?
- dashboard.post (not yet described)
- Use your strongest model
Never: acts without a task someone started; changes its own permissions; sees other agents' files; spends money.
PROOF OF ORIGIN · SIGNED
Publisher: Old School GmbH
Package id: faivr.agent.build-security-reviewer
Version: 1.3.1
Publisher key: ed25519-d0ffc3c27628df9f
Package digest: sha256:cfc2f3adcfe2d752403f743ba8a3f8db93bc646e07030a7833983ebd33dee922
Your Truchsess checks the signature and this digest before it installs the agent. The same digest is shown on your appliance.
Subscribe on your Truchsess, not on this site.