mcpField
S
security-guardian

security-guardian

github.com/caomeiyourenSecurity1278 installsUpdated today
Repository

About security-guardian

security-guardian is a code-review skill for checking secrets, injection risks, authorization, and vulnerable dependencies. It also sets audit procedures for sensitive changes and reporting uncertain findings.

Key features

  1. 01Scan for hard-coded keys and passwords
  2. 02Detect SQL injection and XSS risks
  3. 03Check Session and role validation
  4. 04Audit dependencies in package.json
  5. 05Double-audit sensitive operations

Use cases

  1. 01Review password handling in login logic
  2. 02Check permission calls in server/api changes
  3. 03Assess deletions or sensitive data updates
  4. 04Flag uncertain security logic for manual review

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/caomeiyouren/momei --skill security-guardian

After installing, type/security-guardianin Claude Code to confirm it loaded.

Details

From the project README

Security Guardian Skill (安全守护技能)

能力 (Capabilities)

  • Secrets 扫描: 识别硬编码的 API Key、Token 和密码。
  • 注入检测: 识别潜在的 SQL 注入和 XSS 风险。
  • 越权检测: 检查 API 是否缺少必要的 Session 校验或角色校验。
  • 依赖审计: 检查 package.json 中的不安全包。

指令 (Instructions)

  1. 强制性审计: 在涉及 server/api 变更时，必须检查 server/utils/permission.ts 的调用。
  2. 敏感操作控制: 对删除、敏感数据更新操作进行双重审计。
  3. 不确定性上报: 若无法确定某段逻辑是否安全，必须反馈用户手动核实。

使用示例 (Usage Example)

输入: "审查这个登录逻辑。" 动作: 检查是否使用了安全哈希、是否有速率限制、是否在日志中输出了密码。

Comments

Markdown supported