mcpField
I
inspect-security

inspect-security

github.com/venhdevSecurity152 installsUpdated today
Repository

About inspect-security

inspect-security is an Agent Skill for auditing security risks in a specified file, directory, or subsystem. It enforces a rubric-based scope gate, separates localized fixes from architectural refactors, and produces a structured audit dossier.

Key features

  1. 01Requires an explicit audit target
  2. 02Checks threats, authorization, cryptography, taint sinks, and races
  3. 03Uses a security rubric
  4. 04Classifies findings by remediation scope
  5. 05Produces a structured audit dossier

Use cases

  1. 01Auditing a specified subsystem for security exposure
  2. 02Separating local patches from systemic hardening
  3. 03Reviewing findings against a security rubric

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/venhdev/skills --skill inspect-security

After installing, type/inspect-securityin Claude Code to confirm it loaded.

Bundled filesreferences/security-rubric.md

Details

From the project README

inspect-security — Software Security & Threat Exposure Auditor

Domain Rubric

1. Scope & Tolerability Guardrails (What to Ignore)
  • Mandatory Target Scope: The user MUST specify an explicit target path (file, directory, or subsystem). If no target scope is provided, halt turn immediately and prompt user: "Vui lòng chỉ định rõ phạm vi kiểm tra (file, thư mục hoặc subsystem) khi sử dụng /inspect-security."; forbid speculative full-repository scans.
  • Vulnerability Debt vs. Linter Nits: Confine analysis strictly to actionable threat exposure, broken authorization, cryptographic flaws, taint sinks, and concurrency races; defer basic AST formatting, syntax stylistic preferences, and whitespace entirely to native linters.
  • Governing Reference: Evaluate security patterns strictly against references/security-rubric.md.
2. Decision Bifurcation: [LOCAL-FIX] vs. [ARCHITECTURAL-REFACTOR]
  • [LOCAL-FIX] (Localized In-Function Patch): Parameterizing raw ORM queries, replacing Math.random() with CSPRNG, adding constant-time timingSafeEqual with pre-hashing, strict DTO schema whitelisting, wrapping streams in io.LimitReader, or pinning JWT algorithms. Route behavior-changing remediation to /changeset; use /forge only with a supported, authorized changeset.
  • [ARCHITECTURAL-REFACTOR] (Systemic Structural Hardening): Introducing PostgreSQL Row-Level Security (RLS) for tenant isolation, deploying dedicated Egress Proxies (Smokescreen/Envoy) for SSRF mitigation, implementing Token Family refresh rotation with breach cascades, transitioning balance mutations to atomic conditional SQL / ledgers, or introducing distributed sliding-window rate limiting. Route remediation to /changeset.

Canonical Output Contract

# Security Audit Dossier: <Target Scope>

## 1. Executive Summary
- **Target Inspected**: `<directory_or_file_path>`
- **Security Posture**: <HARDENED | LOCALIZED_RISKS | CRITICAL_EXPOSURE>
- **Primary Threat Vector**: <Single-sentence summary of highest-severity exploit scenario or systemic hazard>

## 2. Load-Bearing Defect Catalog
### [<CRITICAL | HIGH | MEDIUM>] [<LOCAL-FIX | ARCHITECTURAL-REFACTOR>] <Dimension>: `<Target Symbol / Route>`
- **Offending Code**: [<file>#L<N>](file:///path/to/file#L<N>)
- **Violated Rubric**: [<spec_or_dimension>](references/security-rubric.md#anchor)
- **Threat & Exploit Scenario**: <Observable attack vector, failure mode, or privilege escalation scenario>
- **Action**: <[LOCAL-FIX] Local patch OR [ARCHITECTURAL-REFACTOR] Systemic architecture hardening>

*(Emit 'No load-bearing security defects observed across rubric dimensions' if clean)*
Routing
  • A supported changeset already authorizes the security fix and required verification → (via /forge).
  • Local or systemic security patches requiring scope staging, including authorization, crypto, or data-contract changes → (via /changeset).

Execution Protocol

  1. Intake & Scope Gate:

    • Ingest target scope (file, directory, or subsystem).
    • Enforce Scope Gate: If no explicit scope is provided, halt turn immediately and prompt user: "Vui lòng chỉ định rõ phạm vi kiểm tra (file, thư mục hoặc subsystem) khi sử dụng /inspect-security."
    • Read and ground in references/security-rubric.md.

  2. Scale-Adaptive Pragmatic Audit:

    • In-Turn Execution (< 10 files or cohesive module): Audit code directly in-turn against rubric dimensions.
    • Subagent Fan-Out (broad multi-package subsystem): Launch 2–3 research subagents (Role: Security Inspector (<Slice>)) seeded with slice coordinates, discovered anchors, Domain Rubric, and Output Contract.
    • Enforce Section 1 Guardrails: ignore stylistic noise; classify every finding explicitly as [LOCAL-FIX] or [ARCHITECTURAL-REFACTOR].

  3. Synthesis & Turn-Halt Gate:

    • Consolidate findings into the Canonical Output Contract.
    • Assign definitive Security Posture (HARDENED, LOCALIZED_RISKS, CRITICAL_EXPOSURE).
    • Present completed dossier into conversation stream and halt turn immediately.

Comments

Markdown supported