security-diagnose
Skill4 starsChanged 5 days agoMITView on GitHub
Classify suspected web application security weaknesses by actual trust boundary, identify affected ASVS 5.0.0 requirements, and route to a focused security specialist. Use for ambiguous security reports and code review findings.
In this repository55 other files it gives its agents.
- design-balance-and-proportionSkill
- design-brand-and-art-directionSkill
- design-buildSkill
- design-color-theorySkill
- design-diagnoseSkill
- design-hierarchy-and-emphasisSkill
- design-imagery-and-textureSkill
- design-layout-and-gridSkill
- design-movement-and-flowSkill
- design-reviewSkill
- design-rhythm-and-patternSkill
- design-typographySkill
- design-unity-and-systemsSkill
- design-validateSkill
- security-api-files-and-realtimeSkill
- security-authentication-and-sessionsSkill
- security-authorizationSkill
- security-browser-and-originSkill
- security-buildSkill
- security-configuration-and-secretsSkill
- security-crypto-and-dataSkill
- security-dependencies-and-buildSkill
- security-injection-and-validationSkill
- security-logging-and-failureSkill
- security-reviewSkill
- security-threat-model-and-designSkill
- security-validateSkill
- ux-accessibilitySkill
- ux-buildSkill
- ux-controls-and-inputsSkill
- ux-decisions-and-loadSkill
- ux-diagnoseSkill
- ux-feedback-and-performanceSkill
- ux-forms-and-errorsSkill
- ux-journeys-and-motivationSkill
- ux-navigation-and-structureSkill
- ux-onboarding-and-learningSkill
- ux-reviewSkill
- ux-trust-and-ethicsSkill
- ux-validateSkill
- ux-visual-hierarchySkill
- wcag-alternatives-and-mediaSkill
- wcag-assistive-tech-and-statusSkill
- wcag-buildSkill
- wcag-diagnoseSkill
- wcag-forms-and-error-preventionSkill
- wcag-keyboard-and-focusSkill
- wcag-language-and-predictabilitySkill
- wcag-navigation-and-discoverySkill
- wcag-pointer-and-touchSkill
- wcag-reviewSkill
- wcag-semantics-and-reading-orderSkill
- wcag-time-and-motionSkill
- wcag-validateSkill
- wcag-visual-and-responsiveSkill
The file
We split this skill into the rules it gives an agent
4 rules. About 0 are common, 1 is distinctive, and 3 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
3
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 10
Use this skill when an observed behavior, code pattern, architecture, scan finding or user complaint suggests a security weakness.
- Very specific: line 15
Read references/standard-selection.md.
- Very specific: line 16
Use references/issue_taxonomy.json to select one primary category and, if needed, two secondary categories.
- Very specific: line 17
Check references/remediation_recipes.json, OWASP Top 10:2025 awareness mappings and references/nist-ssdf-mapping.json when …
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Diagnose an application security concern
Scope
Use this skill when an observed behavior, code pattern, architecture, scan finding or user complaint suggests a security weakness. Do not turn a hypothesis or scanner alert into a confirmed vulnerability without corroboration. Limit activity to code and systems the user has authorized.
Procedure
- Record the affected asset, data flow, entry point, actor, security boundary, environment and authorized inspection scope. Separate observed evidence from assumptions.
- Read
references/standard-selection.md; resolve the explicit application baseline, project policy or ASVS 5.0.0 Level 2 planning fallback. Confirm whether server-side or infrastructure evidence is available. - Use
references/issue_taxonomy.jsonto select one primary category and, if needed, two secondary categories. Read only matching chapters fromreferences/asvs/5.0.0/index.jsonandreferences/asvs/5.0.0/source-access.mdto obtain full authoritative requirement text when assessing an ID. If unavailable, report it as untested. - Check
references/remediation_recipes.json, OWASP Top 10:2025 awareness mappings andreferences/nist-ssdf-mapping.jsonwhen development-process questions matter. Do not treat an awareness category as an ASVS requirement. - Route to a relevant
security-*specialist and propose a bounded repair or discriminating test. For code changes usesecurity-build; full assessmentsecurity-review; verificationsecurity-validate.
Evidence discipline
Report confirmed weakness, suspected weakness, informational observation and not tested separately. Do not label an unobserved server-side control as pass. Include ASVS version-prefixed IDs, evidence limits, and the safest authorized verification path. Never disclose production secrets or unapproved exploitation steps.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.