Security Shield

6 skills inclus

• 01

  Security Review

  Fait relire le code par l'agent pour trouver les failles exploitables (injection, XSS, IDOR, SSRF, secrets) et ne signaler que ce qui est confirmé.+

  sf-security-review/SKILL.md, de getsentry/skills, licence Apache 2.0.

  1---

  2name: sf-security-review

  3description: "Reviews code, a diff or a pull request for exploitable security vulnerabilities and reports onl…

  4allowed-tools: Read Grep Glob Bash Task

  5---

  6

  7<!--

  8Reference material based on OWASP Cheat Sheet Series (CC BY-SA 4.0)

  9https://cheatsheetseries.owasp.org/

  10-->

  11

  12# Security Review

  13

  14Identify exploitable security vulnerabilities in code. Report only **high-confidence** findings: a clear vuln…

  15

  16## When to use
• 02

  GitHub Actions Security

  Fait auditer les workflows GitHub Actions contre les attaques venues de forks, d'issues ou de commentaires, avec scénario d'exploitation et correctif.+

  sf-gha-security/SKILL.md, de getsentry/skills, licence Apache 2.0.

  1---

  2name: sf-gha-security

  3description: 'Audits GitHub Actions workflows for vulnerabilities an outside attacker can exploit from a fork…

  4allowed-tools: Read Grep Glob Bash Task

  5---

  6

  7<!--

  8Attack patterns and real-world examples sourced from the HackerBot Claw campaign analysis

  9by StepSecurity (2025): https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation

  10-->

  11

  12# GitHub Actions Security Review

  13

  14Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitat…

  15

  16This skill encodes attack patterns from real GitHub Actions exploits, not generic CI/CD theory.
• 03

  Skill Security Scanner

  Fait contrôler un skill d'agent avant installation : injection de prompt, scripts dangereux, permissions excessives, puis verdict clair.+

  sf-skill-scanner/SKILL.md, de getsentry/skills, licence Apache 2.0.

  1---

  2name: sf-skill-scanner

  3description: "Vets an agent skill (SKILL.md, references, scripts) before it is installed: runs a static scann…

  4allowed-tools: Read Grep Glob Bash

  5---

  6

  7# Skill Security Scanner

  8

  9Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive pe…

  10

  11A skill runs with every permission the agent has. Treat each one as untrusted code until this scan says other…

  12

  13## When to use

  14

  15- Before installing a skill or plugin from GitHub, a marketplace or a colleague.

  16- Auditing a whole skills folder (`.claude/skills/`, `.agents/skills/`, `plugins/*/skills/`).
• 04

  Threat Modeling with STRIDE

  Fait construire un modèle de menaces STRIDE : flux de données, frontières de confiance, menaces notées et mesures transformées en tâches testables.+

  sf-threat-modeling/SKILL.md, de wshobson/agents, licence MIT.

  1---

  2name: sf-threat-modeling

  3description: "Builds a STRIDE threat model for a system, feature or architecture change: maps components, dat…

  4---

  5

  6# Threat Modeling with STRIDE

  7

  8Find design-level security flaws before they are code. The output is a short document: what the system is, wh…

  9

  10## When to use

  11

  12- Designing a new feature or service, or changing an architecture (new integration, new data store, new publi…

  13- Before a security review of code that does not exist yet.

  14- Preparing audit or compliance documentation.

  15

  16Not for: reviewing existing code line by line (`sf-security-review`), CI workflows (`sf-gha-security`).
• 05

  Secrets Management

  Fait sortir clés et mots de passe du code : inventaire, coffre de secrets, OIDC en CI, rotation, scan, et procédure en cas de fuite.+

  sf-secrets-management/SKILL.md, de wshobson/agents, licence MIT.

  1---

  2name: sf-secrets-management

  3description: "Keeps API keys, database passwords, tokens and certificates out of code and logs: inventories s…

  4---

  5

  6# Secrets Management

  7

  8A secret belongs in one place (a secret store), reaches only the process that needs it, at runtime, for as sh…

  9

  10## When to use

  11

  12- A new credential enters the project (API key, database URL, signing key, webhook secret).

  13- Hardcoded secrets, committed `.env` files or secrets printed in logs.

  14- Setting up CI/CD or deployment secrets.

  15- Rotation, or a leak.

  16
• 06

  Authentication and Authorization

  Fait mettre en place une authentification et des droits solides : sessions ou jetons, hachage, cookies, CSRF, limitation, contrôle d'accès sans IDOR.+

  sf-auth-patterns/SKILL.md, de wshobson/agents, licence MIT.

  1---

  2name: sf-auth-patterns

  3description: "Designs and implements authentication and authorization that hold up: choosing sessions, JWT or…

  4---

  5

  6# Authentication and Authorization

  7

  8Authentication proves who the caller is. Authorization decides, on the server, for every request, what that c…

  9

  10## When to use

  11

  12- Adding login, signup, password reset, social login, SSO or MFA.

  13- Protecting API routes, server actions or admin areas; adding roles or teams.

  14- Investigating unauthorized access or a user reaching another user's data.

  15

  16Prefer a maintained auth library or provider (the framework's official solution, Auth.js, Better Auth, Clerk,…

Extraits. Les dossiers complets sont livrés après le paiement.

Installation