wct-security
Skill0 starsChanged 3 months agoMITView on GitHub
Run and interpret WCT static security, secret, dependency vulnerability, and SBOM checks. Use for security review, dependency upgrades, trust-boundary code, leaked credentials, or G-SAST, G-SECRET, G-CVE, and G-SBOM failures.
In this repository31 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- .github/copilot-instructions.mdCopilot instructions
- .cursor/rules/wct.mdcCursor rule
- wct-acceptanceSkill
- wct-adoptSkill
- wct-architectureSkill
- wct-crapSkill
- wct-dependenciesSkill
- wct-doctorSkill
- wct-drySkill
- wct-gateSkill
- wct-hardeningSkill
- wct-mutateSkill
- wct-ratchetSkill
- wct-reviewSkill
- wct-securitySkill
- wct-test-honestySkill
- wct-acceptanceSkill
- wct-adoptSkill
- wct-architectureSkill
- wct-crapSkill
- wct-dependenciesSkill
- wct-doctorSkill
- wct-drySkill
- wct-gateSkill
- wct-hardeningSkill
- wct-mutateSkill
- wct-ratchetSkill
- wct-reviewSkill
- wct-test-honestySkill
The file
Files
Run security gates
Run uv run bandit -q -r src tools/wct, uv run semgrep --config governance/semgrep, uv run wct gate --tier commit (its G-SECRET scans read-only), and uv run pip-audit. To inspect secrets directly, run detect-secrets scan --slim and read .secrets.baseline yourself; --baseline rewrites a protected route, so reserve it for regenerations a human will bless. Fix the root issue; never whitelist a finding without a narrow justification, owner, and issue. At trust boundaries retain validation even when minimalism suggests fewer lines.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.