aem-security

Stars8

Forks2

UpdatedMarch 18, 2026 at 02:36

AEM security review — admin resolver, query injection, path validation, exposed endpoints, hardcoded secrets

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

techforum-repo

techforum-repo/aem-claude-code

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	aem-security
description	AEM security review — admin resolver, query injection, path validation, exposed endpoints, hardcoded secrets
allowed-tools	Read, Grep, Glob
argument-hint	[file or class path]

Review $ARGUMENTS for AEM security issues. Report each finding as Blocking / Warning / Suggestion.

Admin ResourceResolver or loginAdministrative usage — Blocking; replace with service user
JCR-SQL2 or XPath query built from untrusted input — Blocking; use bound parameters only
Path-based input passed to repository lookups without validation — Blocking
Hardcoded credentials, tokens, or API keys — Blocking
Request-scoped state stored in an OSGi singleton field — Blocking
Stack traces or internal paths exposed in responses or logs — Warning
Path-based servlet registration without Dispatcher filter consideration — Warning
Service user permissions broader than minimum required — Warning
Sensitive data in log statements — Warning

More from this repository

same repository

aem-accessibility

techforum-repo/aem-claude-code

AEM accessibility review — WCAG 2.1 AA compliance in HTL templates, Coral UI dialogs, and frontend components

2026-03-208

aem-cloudmanager

techforum-repo/aem-claude-code

Cloud Manager and OakPAL review — package filters, embed order, Dispatcher SDK, deployment safety

2026-03-188

aem-headless

techforum-repo/aem-claude-code

AEM headless review — Content Fragment models, GraphQL persisted queries, CF Java integration, CORS, and Dispatcher rules for headless delivery

2026-03-188

aem-oak-index

techforum-repo/aem-claude-code

Oak index review and creation — index type selection, property coverage, evaluatePathRestrictions, async configuration

2026-03-188

aem-performance

techforum-repo/aem-claude-code

AEM performance review — JCR queries, traversal, resolver lifecycle, PostConstruct overhead

2026-03-188

aem-project-conventions

techforum-repo/aem-claude-code

Always-loaded AEM project conventions — naming patterns, package structure, utility library usage, and team-specific standards that Claude applies silently on every task

2026-03-188

name	aem-security
description	AEM security review — admin resolver, query injection, path validation, exposed endpoints, hardcoded secrets
allowed-tools	Read, Grep, Glob
argument-hint	[file or class path]

Review $ARGUMENTS for AEM security issues. Report each finding as Blocking / Warning / Suggestion.

Admin ResourceResolver or loginAdministrative usage — Blocking; replace with service user
JCR-SQL2 or XPath query built from untrusted input — Blocking; use bound parameters only
Path-based input passed to repository lookups without validation — Blocking
Hardcoded credentials, tokens, or API keys — Blocking
Request-scoped state stored in an OSGi singleton field — Blocking
Stack traces or internal paths exposed in responses or logs — Warning
Path-based servlet registration without Dispatcher filter consideration — Warning
Service user permissions broader than minimum required — Warning
Sensitive data in log statements — Warning