Detect path traversal vulnerabilities

Detect path traversal bugs via recon + batched sink verification

Large codebases needing path traversal scanned in parallel without overwhelming context

• · codebase (repo_path)
• · sast/architecture.md

• · sast/pathtraversal-results.md (3-phase findings: vulnerable, likely vulnerable, manual review)

• · Subagents (batched verify 3 sinks each)
• · architecture analysis

sast/architecture.md exists (run sast-analysis first), code readable by agent

• · Missing architecture baseline
• · False negatives on realpath+prefix-check patterns
• · Timeout on >1000 sinks

• · Distinguishes vulnerable/likely-vulnerable/not-vulnerable
• · Lists all mitigation patterns (realpath, basename, allowlist)
• · Shows proof code paths