mcpField
W
w-security

w-security

github.com/blockmatic-iceboxSecurity1647 installsUpdated 4w ago
Repository

About w-security

w-security is a report-first security review skill for coding agents. It uses repository security documentation and existing scanners to assess suspected issues, and only makes fixes when authorized.

Key features

  1. 01Read repository security guidance
  2. 02Review authentication, exposure, and validation
  3. 03Verify triggers and consequences
  4. 04Run documented security checks when authorized
  5. 05Fix issues only with authorization

Use cases

  1. 01Review changed paths for security defects
  2. 02Validate suspected vulnerabilities against repository policy
  3. 03Run existing security checks when approved

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/blockmatic-icebox/basilic-skills --skill w-security

After installing, type/w-securityin Claude Code to confirm it loaded.

Details

From the project README

Find security defects relative to repository security docs and existing scanners. Do not invent CORS, encryption, password, or header policy. Stay report-only unless the user asked to fix.

  1. Read the repository security docs. If missing, stop and ask; do not invent a bar.
  2. Spawn 2–3 read-only explorers on authn/authz, secret/exposure, and input validation for the changed paths. Reconcile trigger and consequence yourself.
  3. Validate each suspected issue with a trigger and consequence. Skip invented CVEs and timings.
  4. If authorized, run existing security scripts or CI jobs from the docs or package.json. Record passed, failed, or not run.
  5. If fixes are authorized, change the owning cause. Policy changes need a human. Docs: /w-docs if behavior or commands changed.

Comments

Markdown supported