mcpField
W
w-security

w-security

github.com/blockmaticSecurity1647 installsUpdated 4w ago
Repository

About w-security

w-security is a repository skill for reviewing security defects against project security documentation and existing scanners. It is report-only unless fixes are authorized, and requires validating each finding's trigger and consequence.

Key features

  1. 01Read repository security docs
  2. 02Explore auth, secrets, and validation
  3. 03Validate triggers and consequences
  4. 04Run documented checks when authorized
  5. 05Report findings without unauthorized fixes

Use cases

  1. 01Reviewing changed paths for security defects
  2. 02Checking a finding before reporting it

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/blockmatic/basilic-skills --skill w-security

After installing, type/w-securityin Claude Code to confirm it loaded.

Details

From the project README

Find security defects relative to repository security docs and existing scanners. Do not invent CORS, encryption, password, or header policy. Stay report-only unless the user asked to fix.

  1. Read the repository security docs. If missing, stop and ask; do not invent a bar.
  2. Spawn 2–3 read-only explorers on authn/authz, secret/exposure, and input validation for the changed paths. Reconcile trigger and consequence yourself.
  3. Validate each suspected issue with a trigger and consequence. Skip invented CVEs and timings.
  4. If authorized, run existing security scripts or CI jobs from the docs or package.json. Record passed, failed, or not run.
  5. If fixes are authorized, change the owning cause. Policy changes need a human. Docs: /w-docs if behavior or commands changed.

Comments

Markdown supported