security-watch
Use when working on security-sensitive code to catch secrets, eval(), innerHTML, and other dangerous patterns before they're written. Activate with /security-watch for real-time security scanning.
소스 정보
- 저장소
- proffesor-for-testing/agentic-qe
- 최근 소스 활동
- 2026년 3월 18일 15:23
- 감지된 SKILL.md 언어
- 영어
- 스타
- 505
- 포크
- 100
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
파일 탐색기
2 개 파일SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- security-watch
- description
- Use when working on security-sensitive code to catch secrets, eval(), innerHTML, and other dangerous patterns before they're written. Activate with /security-watch for real-time security scanning.
- user-invocable
- true
# Security Watch Mode
When activated, scans every file write for common security anti-patterns and blocks dangerous code from being committed.
## What It Does
Flags or blocks writes containing:
- **Secrets**: API keys, passwords, tokens, private keys in source code
- **Dangerous functions**: `eval()`, `Function()`, `innerHTML`, `dangerouslySetInnerHTML`
- **Injection vectors**: Unsanitized template literals in SQL/shell commands
- **Insecure config**: `http://` URLs, disabled TLS verification, `*` CORS origins
## Activation
```
/security-watch
```
## Hook Configuration
```json
{
"hooks": {
"PreToolUse": [
{
"matcher": "Write|Edit",
"hook": ".claude/skills/security-watch/scripts/scan-security.sh"
}
]
}
}
```
## Detection Patterns
```bash
#!/bin/bash
# scan-security.sh
CONTENT="$1"
ISSUES=0
# Secrets detection
SECRET_PATTERNS=(
'AKIA[0-9A-Z]{16}' # AWS Access Key
'sk-[a-zA-Z0-9]{48}' # OpenAI API Key
'ghp_[a-zA-Z0-9]{36}' # GitHub Personal Token
'password\s*[:=]\s*["\x27][^"\x27]+' # Hardcoded passwords
'BEGIN (RSA |EC )?PRIVATE KEY' # Private keys
'sk_live_[a-zA-Z0-9]+' # Stripe secret key
)
for pattern in "${SECRET_PATTERNS[@]}"; do
if echo "$CONTENT" | grep -qP "$pattern"; then
echo "BLOCKED: Potential secret detected matching pattern: $pattern"
ISSUES=$((ISSUES + 1))
fi
done
# Dangerous functions
DANGER_PATTERNS=(
'\beval\s*\('
'\bFunction\s*\('
'\.innerHTML\s*='
'dangerouslySetInnerHTML'
'child_process.*exec\('
'\$\{.*\}.*(?:SELECT|INSERT|UPDATE|DELETE)'
)
for pattern in "${DANGER_PATTERNS[@]}"; do
if echo "$CONTENT" | grep -qP "$pattern"; then
echo "WARNING: Dangerous pattern detected: $pattern"
ISSUES=$((ISSUES + 1))
fi
done
if [ $ISSUES -gt 0 ]; then
echo "Found $ISSUES security issues. Review before proceeding."
exit 1
fi
```
## Gotchas
- False positives on test fixtures that intentionally contain patterns like `eval()` — use `// security-watch:ignore` comment
- Base64-encoded secrets won't be caught — this scans for plaintext patterns only
- Template literal injection detection has false positives on safe string interpolation — review warnings carefully
- This is a first line of defense, not a replacement for proper security review
GitHub에서 보기