agentleFS
Sign inStart free
YehudaFrankelYehudaFrankel/clankbrain/.claude/skills/_archived_03-security/SKILL.md

security-check

Skill16 starsChanged 7 months agoMITView on GitHub

Security audit — checks auth, SQL injection, exposed endpoints, and sensitive data. Triggers on "security check", "is this secure", "check for vulnerabilities", "check auth", "audit security", "security audit".

30 other projects use a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

1 rule. 0 are common, 1 is distinctive, and 0 are very specific to this project.

  • 0

    Common

    Most of the 22 edited versions we read keep these.

  • 1

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Ask: "Fix any of these now, or just flag for later?"

    line 34

“Common” is measured: kept by at least 6 in 10 of the 22 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Security Check

  1. Read the target file(s) fully before reporting anything
  2. Check for authentication issues:
    • Endpoints that should require auth but don't
    • Auth checks that can be bypassed (missing early return on auth failure)
    • Admin routes accessible without privilege check
  3. Check for injection vulnerabilities:
    • SQL values concatenated directly into query strings instead of parameterized
    • User input passed to shell commands, eval, or dynamic code execution
    • Unescaped output rendered as HTML (XSS)
  4. Check for secrets and sensitive data:
    • Hardcoded credentials, API keys, passwords in source files
    • Sensitive data returned in API responses (passwords, internal tokens)
    • Plain-text sensitive values in URLs or logs
  5. Check for insecure direct object references:
    • IDs in requests not validated against the current user's ownership
    • File paths constructed from user input
  6. Report findings in a table:
    FileLineIssueSeverity
  7. Ask: "Fix any of these now, or just flag for later?"
  8. Do not change anything until the user confirms.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free