メニュー
Automated security vulnerability scanning for Python and JavaScript/TypeScript codebases. Detects OWASP Top 10 vulnerabilities, hardcoded secrets, injection risks, and known CVEs with actionable remediation guidance.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Structured task execution with quality gates, parallel waves, and pm-db tracking — solo or with multi-agent teams (--team). Use this skill when the user wants to execute a task list, run implementation tasks, start building a feature from a plan, run tasks in parallel with a team of agents, or says things like 'execute these tasks', 'start building', 'run the implementation', 'execute the plan', 'execute with a team', or 'start phase execute'. Also triggers on '/start-phase execute' and '/start-phase-execute-team' commands.
Assess and score codebase architecture health — layer separation, SOLID compliance, module coupling (FAN-IN/FAN-OUT), circular dependencies, drift from documented patterns. Use whenever the user asks to assess/review/grade architecture quality, wants an architecture score, or asks how healthy the codebase's architecture is. Analysis-only report + refactoring tasks; for docs-vs-code drift use document-hub-analyze.
Deep analysis of codebase for code duplication. Detects exact, structural, and pattern-level duplicates, generates comprehensive reports with refactoring suggestions and metrics.
Use when Mark reports a bug by pasting a raw artifact with little or no prose — a stack trace, an HTTP request/response trace (URL + method + status like 500/403/404/502), a console/React/Prisma error, a ChunkLoadError, a shell error, or a screenshot of a visual defect — or when he says things like 'still failing', 'clicking X does nothing', 'no inline editor on the rendered page', 'do we have local postgres/pgvector?', or 'identify the true error'. This is the front-to-back debugging procedure — extract the trigger and reproduction from terse input, probe whether the underlying plumbing even exists, localize by contrasting known-good vs broken, and drive to a durable root cause rather than a workaround. Reach for this BEFORE proposing any fix.
Deep analysis of codebase vs documentation alignment (cline-docs/). Detects drift, identifies undocumented code, extracts missing glossary terms, and provides actionable recommendations without making changes. Use this skill when the user asks "are the docs up to date", "check documentation quality", "what's missing from the docs", or wants a read-only audit before deciding what to update. For actually making changes, use document-hub-update instead.
Bootstrap a new project's documentation hub by creating the four core documentation files (systemArchitecture.md, keyPairResponsibility.md, glossary.md, techStack.md) with initial content based on codebase analysis.
| name | security-quality-assess |
| description | Automated security vulnerability scanning for Python and JavaScript/TypeScript codebases. Detects OWASP Top 10 vulnerabilities, hardcoded secrets, injection risks, and known CVEs with actionable remediation guidance. |
Comprehensive static security analysis that automatically scans codebases to detect vulnerabilities across OWASP Top 10 (2021) categories.
Use this skill to identify security vulnerabilities early in development, maintain security compliance, and receive actionable remediation guidance for detected issues.
# Scan current project
/security-assess .
# Scan specific directory
/security-assess /path/to/project
# Save report to file
/security-assess . --output security-report.md
# Skip network dependency scanning (faster)
/security-assess . --skip-osv
# Verbose logging for debugging
/security-assess . --verbose
Performs comprehensive security analysis to answer:
Covers OWASP Top 10 (2021) categories A01-A07: access control, cryptographic failures, injection, insecure design, misconfiguration, vulnerable components (CVEs), and authentication failures. Read references/detection-coverage.md for the full per-category list of detected patterns when you need to know exactly what is flagged.
Findings are prioritized for action:
The tool uses exit codes for CI/CD integration:
Suppress false positives with an audit trail via .security-suppress.json (entries support expiration dates and approver fields). Read references/configuration.md for the file format, matching precedence, and expiration rules when suppressing findings.
# Run scan before committing
/security-assess . --output report.md
# Check exit code
if [ $? -eq 0 ]; then
git commit -m "Feature complete"
else
echo "Security issues found - review report.md"
fi
# Run in pipeline with verbose logging
/security-assess . --verbose --output security-report.md
# Fail build on critical/high findings
exit_code=$?
if [ $exit_code -eq 1 ]; then
echo "Security vulnerabilities block merge"
exit 1
fi
# Skip dependency scanning for faster analysis
/security-assess . --skip-osv --output quick-scan.md
The markdown report includes:
Language Support:
False Positives:
Network Dependency:
--skip-osv flag when offline~/.cache/claude-security/osv/Performance:
.gitignore, excludes test filesFull CLI flag reference (--output, --config, --skip-osv, --verbose, --version, --help) is in references/configuration.md — read it when customizing a scan invocation.
This skill provides:
Version: 1.0.0 Status: Production Ready Languages Supported: Python, JavaScript, TypeScript Last Updated: 2026-02-08