batch-security-migration

name	batch-security-migration
description	Use when applying the same security fix across many files or repos at once — large-scale vulnerability remediation. Provides 7 copy-paste /batch recipes (XSS, HTTPS, SQLi, input validation, log PII, secret rotation, CVE patches) each with a safety tier and false-positive trap, plus scan_diff.py to prove the migration introduced no new HIGH/CRITICAL findings.
license	MIT
metadata	{"version":"1.0.0","author":"Diego Consolini"}

Batch Security Migration

Turn Claude Code's built-in /batch into a security-migration tool. This skill does not reinvent /batch — /batch already fans work out into worktree-isolated per-unit PRs. This skill supplies the recipes, the safety tiers, and an objective before/after gate (scripts/scan_diff.py).

When to use

You have the same vulnerability class in many places (dozens of files, or many repos) and want to fix them in one coordinated pass with per-unit review and a regression gate.

Safety tiers

Tier	Meaning
🟢 safe	Mechanical text substitution; review only the flagged dynamic cases.
🟡 review	Semantic change; the per-unit PR review is the gate.
🔴 manual	Never full-auto — high blast radius. Drive /batch one unit at a time with a human + test run per unit.

Pre-scan checklist

1. Clean git tree (git status empty) — /batch needs a clean base.
2. Run a baseline scan: scan_plugin.py <target> --output before.json --format json.
3. Confirm /batch is available (Claude Code ≥ 2.1.63).
4. Scope to a subdirectory first; don't run repo-wide on the first pass.
5. Ensure the existing test suite passes before you start.

Recipes

#	Recipe	Tier	False-positive trap	Verify
1	XSS: innerHTML → textContent	🟢 safe	dynamic-HTML assignment is intentional in a few spots	grep should drop for static cases
2	HTTPS: http:// → https://	🟢 safe	localhost / 127.0.0.1 / example URLs must be excluded	no http:// outside the allowlist
3	SQLi: string-concat → parameterized	🟡 review	not every concatenated string is a query	per-unit PR review
4	Input validation on route handlers	🟡 review	may add a dependency; verify handler coverage	tests + handler list
5	Log sanitization: strip PII from logs	🟡 review	regex over-match can corrupt non-PII logs	check redaction correctness
6	Secret rotation: hardcoded key → env var	🔴 manual	test fixtures look like real secrets	manual per unit + secret scan
7	Dependency CVE patch updates	🔴 manual	a patch can break an API	test run per bump

1. XSS: innerHTML → textContent (🟢)

/batch over files matching grep -rl 'innerHTML' src/: "Replace element.innerHTML = x with element.textContent = x where x is plain text. Leave intentional HTML injection (templating, sanitized fragments) and add a // reviewed: dynamic HTML comment instead." Verify: grep -rn 'innerHTML' src/ returns only reviewed cases.

2. HTTPS: http:// → https:// (🟢)

/batch: "Replace http:// with https:// in source and config. Do NOT touch localhost, 127.0.0.1, 0.0.0.0, example.com, or XML namespace URIs." Verify: grep -rn 'http://' . | grep -v -E 'localhost|127\.0\.0\.1|example\.' is empty.

3. SQLi: parameterized queries (🟡)

/batch: "Convert string-concatenated SQL into parameterized queries for the driver in use. Each file is its own PR — flag any query you can't safely parameterize." Review every per-unit PR; this is semantic.

4. Input validation on route handlers (🟡)

/batch: "Add input validation to each Express/route handler using the project's existing validation library. If none exists, flag the unit instead of adding a new dependency." Verify handler coverage and that no unintended dependency was added.

5. Log sanitization: strip PII (🟡)

/batch: "Wrap log statements that emit email/SSN/credit-card values in the project's redaction helper. Don't redact non-PII." Check redaction correctness — regexes over-match.

6. Secret rotation: hardcoded key → env var (🔴 manual)

Drive /batch one unit at a time. "Replace a hardcoded secret with os.environ[...] / process.env... and add it to .env.example." Trap: test fixtures and example keys look like real secrets — never full-auto. After: rotate every real key that was exposed.

7. Dependency CVE patch updates (🔴 manual)

Drive /batch one bump at a time. "Update to the patched version for ." Trap: patches can break APIs — run the full test suite per bump before merging.

Post-migration workflow

1. Merge the per-unit PRs /batch produced.
2. Re-scan: scan_plugin.py <target> --output after.json --format json.
3. Gate: python3 scripts/scan_diff.py before.json after.json
   • exit 0 + "GATE: PASS" → no new HIGH/CRITICAL; ship.
   • exit 1 + "GATE: FAIL" → triage the listed NEW findings, or re-run with --report-only once you've justified them.

Or let scan_diff run both scans for you: python3 scripts/scan_diff.py --scan <target_before> <target_after>