mcpField
S
security-watch

security-watch

github.com/proffesor-for-testingSecurity51960 installsUpdated today
Repository

About security-watch

security-watch is a Claude skill that scans file writes for common security anti-patterns and blocks detected risks. It is intended for code changes, with plaintext pattern checks and an explicit warning that it does not replace security review.

Key features

  1. 01Scans file writes for secrets
  2. 02Flags dangerous functions
  3. 03Detects injection patterns
  4. 04Checks insecure configuration
  5. 05Supports ignore comments

Use cases

  1. 01Preventing secrets from entering source code
  2. 02Checking writes during code changes
  3. 03Reviewing possible SQL or shell injection
  4. 04Allowing intentional test patterns with an ignore comment

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/proffesor-for-testing/agentic-qe --skill security-watch

After installing, type/security-watchin Claude Code to confirm it loaded.

Bundled filesscripts/scan-security.sh

Details

From the project README

Security Watch Mode

When activated, scans every file write for common security anti-patterns and blocks dangerous code from being committed.

What It Does

Flags or blocks writes containing:

  • Secrets: API keys, passwords, tokens, private keys in source code
  • Dangerous functions: eval(), Function(), innerHTML, dangerouslySetInnerHTML
  • Injection vectors: Unsanitized template literals in SQL/shell commands
  • Insecure config: http:// URLs, disabled TLS verification, * CORS origins

Activation

/security-watch

Hook Configuration

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Write|Edit",
        "hook": ".claude/skills/security-watch/scripts/scan-security.sh"
      }
    ]
  }
}

Detection Patterns

#!/bin/bash
# scan-security.sh
CONTENT="$1"
ISSUES=0

# Secrets detection
SECRET_PATTERNS=(
  'AKIA[0-9A-Z]{16}'                    # AWS Access Key
  'sk-[a-zA-Z0-9]{48}'                  # OpenAI API Key
  'ghp_[a-zA-Z0-9]{36}'                 # GitHub Personal Token
  'password\s*[:=]\s*["\x27][^"\x27]+'  # Hardcoded passwords
  'BEGIN (RSA |EC )?PRIVATE KEY'         # Private keys
  'sk_live_[a-zA-Z0-9]+'                # Stripe secret key
)

for pattern in "${SECRET_PATTERNS[@]}"; do
  if echo "$CONTENT" | grep -qP "$pattern"; then
    echo "BLOCKED: Potential secret detected matching pattern: $pattern"
    ISSUES=$((ISSUES + 1))
  fi
done

# Dangerous functions
DANGER_PATTERNS=(
  '\beval\s*\('
  '\bFunction\s*\('
  '\.innerHTML\s*='
  'dangerouslySetInnerHTML'
  'child_process.*exec\('
  '\$\{.*\}.*(?:SELECT|INSERT|UPDATE|DELETE)'
)

for pattern in "${DANGER_PATTERNS[@]}"; do
  if echo "$CONTENT" | grep -qP "$pattern"; then
    echo "WARNING: Dangerous pattern detected: $pattern"
    ISSUES=$((ISSUES + 1))
  fi
done

if [ $ISSUES -gt 0 ]; then
  echo "Found $ISSUES security issues. Review before proceeding."
  exit 1
fi

Gotchas

  • False positives on test fixtures that intentionally contain patterns like eval() — use // security-watch:ignore comment
  • Base64-encoded secrets won't be caught — this scans for plaintext patterns only
  • Template literal injection detection has false positives on safe string interpolation — review warnings carefully
  • This is a first line of defense, not a replacement for proper security review

Comments

Markdown supported