secure
Shortcut for security review on current change set. Runs layered checks (secret-scan, dep-audit, semgrep, OWASP patterns, prompt-injection review). Use for a security check, to scan for vulns, or to run security review.
- License 许可
- MIT
- 最近更新
- 2026-11-11
- Stars
- ★ 1
- Forks
- 1
01 前言 Front Matter
- name
- secure
- triggers
- [ "secure this", "security check", "scan for vulns", "run security review" ]
- description
- Shortcut for security review on current change set. Runs layered checks (secret-scan, dep-audit, semgrep, OWASP patterns, prompt-injection review). Use for a security check, to scan for vulns, or to run security review.
02 资源文件 1
- 参考文档manifest.json940 B
03 SKILL.md 正文
Secure
Shortcut for security review on current change set. Runs a layered check: secret-scan (trufflehog), dep-audit, semgrep, OWASP top-10 pattern sweep, and prompt-injection review if agent-touching code.
Purpose
Gate changes for security before shipping. Thin wrapper around existing security-review / security-audit skills, orchestrated into a single invocation.
What Gets Scanned
| Layer | Tool | Detects |
|---|---|---|
| Secrets | trufflehog | API keys, credentials, private keys |
| Dependencies | npm audit, pip audit | Known vulns in transitive deps |
| Code patterns | semgrep | OWASP Top 10, injection flaws, unsafe DOM |
| Prompt injection | Custom rules | Template injection, prompt stuffing, jailbreak patterns |
Invocation
secure # Scan staged changes
secure --staged # Explicit staged
secure --branch <branch> # Scan diff vs main
secure --file <path> # Single file
secure --fix # Attempt auto-fix (secrets rotate, deps upgrade)
Example Output
Running secure check...
[OK] Secrets: 0 findings
[OK] Dependencies: 1 high vuln detected in lodash (fixed in v4.17.21, yours: v4.17.20)
[WARN] Semgrep: 2 findings
- CWE-79 (XSS): unsafe innerHTML in auth-form.tsx:42
- CWE-89 (SQL Injection): dynamic query in db-service.ts:105
[OK] Prompt injection: 0 findings
Summary: 2 warnings, 0 errors
Next: Fix findings or run `secure --fix` for suggestions
Interpretation Guide
| Severity | Action |
|---|---|
| Error | Block merge; fix before shipping |
| High | Fix or document exception with JIRA ticket |
| Medium | Plan fix; merge with caution |
| Low | Log for backlog; merge OK |
AI Agent Code Special Rules
If changes touch src/agents/, packages/core/kit/core/agents/, or prompt-building logic, ALWAYS run extra prompt-injection scan:
secure --agents-mode
Detects:
- User-controlled input fed directly to LLM prompts
- Unescaped template variables in agent instructions
- Jailbreak patterns in example payloads
References
- Full security audit:
security-auditskill - Best practices:
packages/core/best-practices/security.md - Prompt defense:
packages/core/patterns/prompt-injection-defense.md - OWASP Top 10: owasp.org
04 同仓库更多 Skills
token-audit
Audit historical Claude Code token usage from JSONL session files — shows total spend, cache hit rates, top costly sessions, weekly trends, and where tokens are going. Run after heavy sessions or weekly to measure optimization impact. Answers how many tokens a session used, how expensive was that session, session cost, and token usage report.
smart-model-route
Auto-classify prompt complexity via Haiku (with heuristic fallback) and inject model routing hints for Agent tool calls. Wired as a UserPromptSubmit hook — fires on every prompt, routes low tasks to Haiku, standard to Sonnet, complex to Sonnet with thorough reasoning, and critical (security/arch/migrations) to Opus. Handles model selection, for example choose model by task complexity.
smart-commands
Decision guide for when to proactively use Claude Code slash commands — /think, /model, /compact, /clear. Use when choosing whether to invoke a command before or during a task, or when a complexity-classifier hook has flagged a task as high or critical. Pairs with the complexity-classifier UserPromptSubmit hook. Answers when to compact, should I switch models, and whether to use extended thinking. Use to pick the right /model command and switch model.
spec-ship
暂无简介
spec-new
Create a committed per-feature spec under `docs/specs/YYYY-MM-DD-<slug>/{spec,tasks}.md` with frontmatter (status, created, owner, pr, tags). Promotes an ephemeral `.claude/plans/<name>.md` into a persistent, searchable artifact. Use when starting a feature that's larger than a one-shot PR.
roadmap-refresh
Regenerate `docs/roadmap.md` for a repo from all specs under `docs/specs/` + their frontmatter (status, tags, pr). Produces Now/Next/Recently-shipped sections. Run after creating / shipping a spec, or at the start of a new session for orientation.