mirror of
https://github.com/anthropics/claude-plugins-official.git
synced 2026-06-10 18:23:36 +00:00
Compare commits
1 Commits
morganl/co
...
bump/teamc
| Author | SHA1 | Date | |
|---|---|---|---|
|
76c847a20f |
@@ -291,7 +291,7 @@
|
||||
"url": "https://github.com/aws/agent-toolkit-for-aws.git",
|
||||
"path": "plugins/aws-agents",
|
||||
"ref": "main",
|
||||
"sha": "55b9acfefdcf0866b6bc6cc56c16e6e18e65bd2b"
|
||||
"sha": "df13dea64baaa1b7031b25d1b2f380756131efec"
|
||||
},
|
||||
"homepage": "https://github.com/aws/agent-toolkit-for-aws"
|
||||
},
|
||||
@@ -320,7 +320,7 @@
|
||||
"url": "https://github.com/aws/agent-toolkit-for-aws.git",
|
||||
"path": "plugins/aws-core",
|
||||
"ref": "main",
|
||||
"sha": "55b9acfefdcf0866b6bc6cc56c16e6e18e65bd2b"
|
||||
"sha": "df13dea64baaa1b7031b25d1b2f380756131efec"
|
||||
},
|
||||
"homepage": "https://github.com/aws/agent-toolkit-for-aws"
|
||||
},
|
||||
@@ -336,7 +336,7 @@
|
||||
"url": "https://github.com/aws/agent-toolkit-for-aws.git",
|
||||
"path": "plugins/aws-data-analytics",
|
||||
"ref": "main",
|
||||
"sha": "55b9acfefdcf0866b6bc6cc56c16e6e18e65bd2b"
|
||||
"sha": "df13dea64baaa1b7031b25d1b2f380756131efec"
|
||||
},
|
||||
"homepage": "https://github.com/aws/agent-toolkit-for-aws"
|
||||
},
|
||||
@@ -472,7 +472,7 @@
|
||||
"source": {
|
||||
"source": "url",
|
||||
"url": "https://github.com/brightdata/skills.git",
|
||||
"sha": "bd5bd76bc889f54b744bab3db3cbd42751a1e5b0"
|
||||
"sha": "3e6d0838285cbc107b86d61e2e1a943baf7ead29"
|
||||
},
|
||||
"homepage": "https://docs.brightdata.com"
|
||||
},
|
||||
@@ -502,7 +502,7 @@
|
||||
"url": "https://github.com/carta/plugins.git",
|
||||
"path": "plugins/carta-cap-table",
|
||||
"ref": "main",
|
||||
"sha": "9eb312908f4a2e2d15e4e935320981433a549f77"
|
||||
"sha": "0227331a2f2e5bc34485f3473d1046a3a52084d7"
|
||||
},
|
||||
"homepage": "https://carta.com"
|
||||
},
|
||||
@@ -518,7 +518,7 @@
|
||||
"url": "https://github.com/carta/plugins.git",
|
||||
"path": "plugins/carta-crm",
|
||||
"ref": "main",
|
||||
"sha": "9eb312908f4a2e2d15e4e935320981433a549f77"
|
||||
"sha": "0227331a2f2e5bc34485f3473d1046a3a52084d7"
|
||||
},
|
||||
"homepage": "https://carta.com"
|
||||
},
|
||||
@@ -534,7 +534,7 @@
|
||||
"url": "https://github.com/carta/plugins.git",
|
||||
"path": "plugins/carta-investors",
|
||||
"ref": "main",
|
||||
"sha": "9eb312908f4a2e2d15e4e935320981433a549f77"
|
||||
"sha": "0227331a2f2e5bc34485f3473d1046a3a52084d7"
|
||||
},
|
||||
"homepage": "https://carta.com"
|
||||
},
|
||||
@@ -561,7 +561,7 @@
|
||||
"source": {
|
||||
"source": "url",
|
||||
"url": "https://github.com/ChromeDevTools/chrome-devtools-mcp.git",
|
||||
"sha": "702d3734f276a18efd67561ae00b88ce954cc515"
|
||||
"sha": "7afd01673f99126e3cd98eb7f62190d7784ef71a"
|
||||
},
|
||||
"homepage": "https://github.com/ChromeDevTools/chrome-devtools-mcp"
|
||||
},
|
||||
@@ -804,7 +804,7 @@
|
||||
"source": {
|
||||
"source": "url",
|
||||
"url": "https://github.com/CodSpeedHQ/codspeed.git",
|
||||
"sha": "c6112f168b405df8e7310b12a9b80484cd01ac14"
|
||||
"sha": "9793aaf9c8198eec58a5fa63d940712bf33b3fc5"
|
||||
},
|
||||
"homepage": "https://codspeed.io"
|
||||
},
|
||||
@@ -1150,7 +1150,7 @@
|
||||
"url": "https://github.com/expo/skills.git",
|
||||
"path": "plugins/expo",
|
||||
"ref": "main",
|
||||
"sha": "c38860242118df93d4ec4381a34f4144fff61928"
|
||||
"sha": "145a923cce95c2cef20643302e8811363fa2e51d"
|
||||
},
|
||||
"homepage": "https://github.com/expo/skills/blob/main/plugins/expo/README.md"
|
||||
},
|
||||
@@ -1361,7 +1361,7 @@
|
||||
"source": {
|
||||
"source": "url",
|
||||
"url": "https://github.com/heygen-com/hyperframes.git",
|
||||
"sha": "25420bf4cfc37b179b4efeace9db25a7178b61bf"
|
||||
"sha": "1fd1b3164a87221fbb5c9e01557125d13e829554"
|
||||
},
|
||||
"homepage": "https://hyperframes.heygen.com"
|
||||
},
|
||||
@@ -1415,7 +1415,7 @@
|
||||
"source": "github",
|
||||
"repo": "jfrog/claude-plugin",
|
||||
"commit": "259c8e718266c16e99b4f30ae9b1ed0f9f00d98d",
|
||||
"sha": "117febaa29cbe9449cfb42d1c39b83b858d801a1"
|
||||
"sha": "8324c7fc9a5561398fe57b8a56db53bdbf1e2cda"
|
||||
},
|
||||
"homepage": "https://jfrog.com"
|
||||
},
|
||||
@@ -1839,7 +1839,7 @@
|
||||
"url": "https://github.com/NVIDIA/skills.git",
|
||||
"path": "plugins/nvidia-skills",
|
||||
"ref": "main",
|
||||
"sha": "0482ebce81bd8f2d39990317bb3cfb07637e39fd"
|
||||
"sha": "e29b3c65dd0292e3f9f851b15eefe5a7c2023dd7"
|
||||
},
|
||||
"homepage": "https://github.com/NVIDIA/skills"
|
||||
},
|
||||
@@ -1855,7 +1855,7 @@
|
||||
"url": "https://github.com/oracle-samples/oracle-aidp-samples.git",
|
||||
"path": "ai/claude-code-plugins/oracle-ai-data-platform-workbench-spark-connectors",
|
||||
"ref": "main",
|
||||
"sha": "00cedef34c99d642d969f87965736768de01cbd6"
|
||||
"sha": "04cc355fbb01402402dd69a4a425a078413a28ea"
|
||||
},
|
||||
"homepage": "https://docs.oracle.com/en/cloud/paas/ai-data-platform/index.html"
|
||||
},
|
||||
@@ -1995,7 +1995,7 @@
|
||||
"source": {
|
||||
"source": "url",
|
||||
"url": "https://github.com/PostHog/ai-plugin.git",
|
||||
"sha": "db4a86632293ca66eec9a6d278786ddb22c1787e"
|
||||
"sha": "9105eb4d6f00623ea782fbf61257f1ce94ba7dac"
|
||||
},
|
||||
"homepage": "https://posthog.com/docs/model-context-protocol"
|
||||
},
|
||||
@@ -2088,7 +2088,7 @@
|
||||
"source": {
|
||||
"source": "url",
|
||||
"url": "https://github.com/qdrant/skills.git",
|
||||
"sha": "82337ccd4be601e52871f101844d57b2adbac52b"
|
||||
"sha": "11df00a7b62b0cd1a552baac63ac821df1aa9eed"
|
||||
},
|
||||
"homepage": "https://skills.qdrant.tech"
|
||||
},
|
||||
@@ -2163,7 +2163,7 @@
|
||||
"source": "url",
|
||||
"url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
|
||||
"path": "revenuecat",
|
||||
"sha": "473fd504bf13d25e76bf4a0267b42be3794f6266"
|
||||
"sha": "b34f9bebe02ceb7e3f32e6d7d081cdfb2e7c37a6"
|
||||
},
|
||||
"homepage": "https://www.revenuecat.com"
|
||||
},
|
||||
@@ -2215,7 +2215,7 @@
|
||||
"source": "url",
|
||||
"url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
|
||||
"path": "revenuecat",
|
||||
"sha": "473fd504bf13d25e76bf4a0267b42be3794f6266"
|
||||
"sha": "b34f9bebe02ceb7e3f32e6d7d081cdfb2e7c37a6"
|
||||
},
|
||||
"homepage": "https://www.revenuecat.com"
|
||||
},
|
||||
@@ -2348,7 +2348,7 @@
|
||||
"url": "https://github.com/SAP/open-ux-tools.git",
|
||||
"path": "packages/fiori-mcp-server",
|
||||
"ref": "main",
|
||||
"sha": "fbfe8c32fb9fc64583aa72ac03ab64f553c407ee"
|
||||
"sha": "f6e9ae1f44a45886c14f6c2c6f31fc06e256c3e2"
|
||||
},
|
||||
"homepage": "https://github.com/SAP/open-ux-tools/tree/main/packages/fiori-mcp-server"
|
||||
},
|
||||
@@ -2431,7 +2431,7 @@
|
||||
"url": "https://github.com/getsentry/cli.git",
|
||||
"path": "plugins/sentry-cli",
|
||||
"ref": "main",
|
||||
"sha": "9e9fe0fb6444f18ed109058b2749cced3c21f87e"
|
||||
"sha": "329f5c5d2e0d97f26a121fb636b58b7eb81d3a8e"
|
||||
},
|
||||
"homepage": "https://sentry.io"
|
||||
},
|
||||
@@ -2676,7 +2676,7 @@
|
||||
"source": {
|
||||
"source": "url",
|
||||
"url": "https://github.com/JetBrains/teamcity-cli.git",
|
||||
"sha": "67e21f0be908daa7ca1e04c8016d1bc81750baee"
|
||||
"sha": "5b57662b826b4b303fe89d91040a05c31210beed"
|
||||
},
|
||||
"homepage": "https://www.jetbrains.com/teamcity/"
|
||||
},
|
||||
@@ -2803,7 +2803,7 @@
|
||||
"url": "https://github.com/val-town/plugins.git",
|
||||
"path": "plugin",
|
||||
"ref": "main",
|
||||
"sha": "02631f998eda9b88d73d699703b062db059d506b"
|
||||
"sha": "a3e884685d1914f28ce029e4f35acd17442e883f"
|
||||
},
|
||||
"homepage": "https://val.town"
|
||||
},
|
||||
@@ -2881,7 +2881,7 @@
|
||||
"source": {
|
||||
"source": "url",
|
||||
"url": "https://github.com/wix/skills.git",
|
||||
"sha": "188ed338f39d70e5aef7f9a2582bbf338f223b78"
|
||||
"sha": "8ed898abcfa5fb3ff8e43c4c1c39d7a55d9cedef"
|
||||
},
|
||||
"homepage": "https://dev.wix.com/docs/wix-cli/guides/development/about-wix-skills"
|
||||
},
|
||||
|
||||
@@ -24,10 +24,6 @@ mkdir -p legacy && ln -s /path/to/your/legacy/codebase legacy/billing
|
||||
|
||||
`/modernize-assess` works best with [`scc`](https://github.com/boyter/scc) (LOC + complexity + COCOMO) or [`cloc`](https://github.com/AlDanial/cloc), and falls back to `find`/`wc` if neither is installed. Portfolio mode also benefits from [`lizard`](https://github.com/terryyin/lizard) (cyclomatic complexity). The commands degrade gracefully without them, but the metrics will be coarser.
|
||||
|
||||
## Secret handling
|
||||
|
||||
Legacy systems routinely contain live credentials, and assessment artifacts get committed and shared. **Every agent in this plugin masks credential values** — findings, rule-card parameters, architecture notes, and test fixtures cite `file:line` with a masked preview (`AKIA****`), never the value. When credentials are found, a per-credential inventory (type, location, blast radius, rotation recommendation) is written to `analysis/<system>/SECRETS.local.md`, which the commands gitignore before writing; on non-git projects the quarantine file goes to `~/.modernize/<system>/` instead. `/modernize-harden` splits its remediation diff so credential-removal hunks (which necessarily contain the raw value) land in a gitignored `security_remediation.local.patch`, never the shareable patch. Pass `--show-secrets` to include raw values in the quarantine file (and only there). If you ran an earlier version of this plugin on a real system, check whether `analysis/` artifacts containing credentials were committed or shared, and rotate anything that was.
|
||||
|
||||
## Commands
|
||||
|
||||
The commands are designed to be run in order, but each produces a standalone artifact so you can stop, review, and resume.
|
||||
|
||||
@@ -29,12 +29,6 @@ For **transformed code**:
|
||||
- Does the test suite actually pin behavior, or just exercise code paths?
|
||||
- What would the on-call engineer need at 3am that isn't here?
|
||||
|
||||
## Secret handling (mandatory)
|
||||
|
||||
When a finding quotes code containing a credential, key, token, or
|
||||
connection string, mask the value (`'Pr0d****'`) and cite `file:line` —
|
||||
findings get appended verbatim to committed notes files.
|
||||
|
||||
## Output
|
||||
|
||||
Findings ranked **Blocker / High / Medium / Nit**. Each with: what, where,
|
||||
|
||||
@@ -40,15 +40,6 @@ of the technology, skip it.
|
||||
from structure/names), **Low** (ambiguous; needs SME).
|
||||
6. If confidence < High, write the exact question an SME must answer.
|
||||
|
||||
## Secret handling (mandatory)
|
||||
|
||||
Rule parameters sometimes *are* credentials — hardcoded passwords in auth
|
||||
checks, API keys in partner-service calls, connection strings in batch
|
||||
routines. Record the **rule**, never the **value**: write the parameter as
|
||||
`<credential — masked, see file:line>` with at most a 2–4 character
|
||||
preview. Rule cards flow into briefs and steering decks; a raw credential
|
||||
in a parameter list is a leak.
|
||||
|
||||
## Output format
|
||||
|
||||
One "Rule Card" per rule (see the format in the `/modernize-extract-rules`
|
||||
|
||||
@@ -32,15 +32,6 @@ and explain it in terms a modern engineer can act on.
|
||||
- **Note what's missing.** Unhandled error paths, TODO comments, commented-out
|
||||
blocks, magic numbers — these are signals about history and risk.
|
||||
|
||||
## Secret handling (mandatory)
|
||||
|
||||
Legacy code is full of live credentials, and your findings get copied into
|
||||
shareable reports. When the evidence for a finding — hardcoded config,
|
||||
dead code, debt, an interface payload — includes a credential, API key,
|
||||
token, connection string, or private key, **never reproduce the value**.
|
||||
Cite `file:line` with a masked preview (`VALUE 'Pr0d****'`,
|
||||
`password=****`). The finding is the practice, not the value.
|
||||
|
||||
## Output format
|
||||
|
||||
Default to structured markdown: tables for inventories, Mermaid for graphs,
|
||||
|
||||
@@ -39,30 +39,7 @@ terminal/screen items don't apply to a SPA. Work through what's relevant:
|
||||
|
||||
Use available SAST where it helps (npm audit, pip-audit, grep for known-bad
|
||||
patterns) but **read the code** — tools miss logic flaws. Show tool output
|
||||
verbatim — except secret values, which you redact (see below) — then add
|
||||
your manual findings.
|
||||
|
||||
## Secret handling (mandatory)
|
||||
|
||||
Legacy codebases routinely contain live production credentials, and your
|
||||
findings get pasted into decks, tickets, and committed markdown. Copying a
|
||||
secret into a report multiplies the exposure you were hired to find.
|
||||
|
||||
When you discover a hardcoded credential, API key, token, connection
|
||||
string, or private key:
|
||||
|
||||
- **Never write the secret's value into any output** — no finding table,
|
||||
no report, no quoted code excerpt, no echoed tool output. Mask it to the
|
||||
first 2–4 identifying characters plus `****` (`AKIA****`,
|
||||
`postgres://app_user:****@db-prod…`). If a scanner prints a secret,
|
||||
redact it before including the excerpt.
|
||||
- Cite `file:line`. The source file is the canonical location — anyone who
|
||||
legitimately needs the value can open it there.
|
||||
- State what the credential appears to grant access to (database, queue,
|
||||
cloud account, third-party API) and whether it looks like a production
|
||||
or test credential.
|
||||
- Recommend rotation for anything that looks live — exposure in source
|
||||
means it is already compromised, independent of any modernization plan.
|
||||
verbatim, then add your manual findings.
|
||||
|
||||
## Reporting standard
|
||||
|
||||
|
||||
@@ -28,15 +28,6 @@ someone thinks it should do) so that a rewrite can be proven equivalent.
|
||||
`@Disabled("pending RULE-NNN")` / `@pytest.mark.skip` / `it.todo()` — never
|
||||
deleted.
|
||||
|
||||
## Secret handling (mandatory)
|
||||
|
||||
Never copy credential-like literals — passwords, API keys, tokens,
|
||||
connection strings — from legacy code into test fixtures. Tests live in
|
||||
the deliverable codebase and get committed. Substitute clearly-fake values
|
||||
of the same shape and length and note the substitution in a comment.
|
||||
Anything a test genuinely needs live (e.g. a real database connection for
|
||||
a dual-run harness) is read from an environment variable, never inlined.
|
||||
|
||||
## Output
|
||||
|
||||
Idiomatic tests for the requested target stack (JUnit 5 / pytest / Vitest /
|
||||
|
||||
@@ -1,13 +1,11 @@
|
||||
---
|
||||
description: Full discovery & portfolio analysis of a legacy system — inventory, complexity, debt, effort estimation
|
||||
argument-hint: <system-dir> [--show-secrets] | --portfolio <parent-dir>
|
||||
argument-hint: <system-dir> | --portfolio <parent-dir>
|
||||
---
|
||||
|
||||
**Mode select.** If `$ARGUMENTS` starts with `--portfolio`, run **Portfolio
|
||||
mode** against the directory that follows. Otherwise run **Single-system
|
||||
mode** against the system dir. Parse flags positionally-independently:
|
||||
`--show-secrets` may appear before or after the system dir — the system
|
||||
dir is the first non-flag token.
|
||||
mode** against `legacy/$1`.
|
||||
|
||||
---
|
||||
|
||||
@@ -110,16 +108,12 @@ Spawn three subagents **in parallel**:
|
||||
2. **legacy-analyst** — "Identify technical debt in legacy/$1: dead code,
|
||||
deprecated APIs, copy-paste duplication, god objects/programs, missing
|
||||
error handling, hardcoded config. Return the top 10 findings ranked by
|
||||
remediation value, each with file:line evidence. If evidence contains a
|
||||
credential value, mask it per your secret-handling rules — never quote
|
||||
it."
|
||||
remediation value, each with file:line evidence."
|
||||
|
||||
3. **security-auditor** — "Scan legacy/$1 for security vulnerabilities:
|
||||
injection, auth weaknesses, hardcoded secrets, vulnerable dependencies,
|
||||
missing input validation. Return findings in CWE-tagged table form with
|
||||
file:line evidence and severity. Mask every discovered credential value
|
||||
per your secret-handling rules — file:line plus a 2–4 character masked
|
||||
preview, never the value itself."
|
||||
file:line evidence and severity."
|
||||
|
||||
Wait for all three. Synthesize their findings.
|
||||
|
||||
@@ -147,31 +141,6 @@ need explained.
|
||||
|
||||
## Step 6 — Write the assessment
|
||||
|
||||
**Secrets quarantine first.** The assessment gets shared and committed —
|
||||
discovered credential values must never appear in it. If the
|
||||
security-auditor found any hardcoded credentials:
|
||||
|
||||
1. Ensure `analysis/.gitignore` exists and contains the lines
|
||||
`SECRETS.local.md` and `*.local.patch` (create or append as needed —
|
||||
the patch pattern is used by `/modernize-harden`; writing both now
|
||||
means the ignore set is complete from first contact). If the project is a
|
||||
git repo, verify with `git check-ignore -q analysis/$1/SECRETS.local.md`
|
||||
— do not write any findings until the check passes. If there is **no
|
||||
git repo** (check for `.svn`/`.hg`/`CVS` too — a `.gitignore` protects
|
||||
nothing under another VCS): refuse `--show-secrets` and write
|
||||
`SECRETS.local.md` to `~/.modernize/$1/` instead of the project tree,
|
||||
telling the user where it went and why.
|
||||
2. Write `SECRETS.local.md`: one row per credential — masked preview,
|
||||
`file:line`, credential type, what it grants access to,
|
||||
production/test guess, rotation recommendation. Only if the user passed
|
||||
`--show-secrets`, add the raw value column here — this file only, never
|
||||
ASSESSMENT.md.
|
||||
3. Masking applies to **every section of ASSESSMENT.md**, whichever agent
|
||||
produced the finding — the Technical Debt section quotes hardcoded
|
||||
config; those quotes follow the same masking rule as Security Findings.
|
||||
The Security Findings section adds a one-line pointer:
|
||||
"Credential inventory in SECRETS.local.md (gitignored; not for sharing)."
|
||||
|
||||
Create `analysis/$1/ASSESSMENT.md` with these sections:
|
||||
- **Executive Summary** (3-4 sentences: what it is, how big, how risky, headline recommendation)
|
||||
- **System Inventory** (the scc table + tech fingerprint)
|
||||
|
||||
@@ -46,7 +46,7 @@ Merge the three result sets. Deduplicate. For each distinct rule, write a
|
||||
When <trigger>
|
||||
Then <outcome>
|
||||
[And <additional outcome>]
|
||||
**Parameters:** <constants, rates, thresholds with their current values — credentials masked: `<credential — masked, see file:line>`>
|
||||
**Parameters:** <constants, rates, thresholds with their current values>
|
||||
**Edge cases handled:** <list>
|
||||
**Suspected defect:** <optional — legacy behavior that looks wrong; decide preserve-vs-fix during transform>
|
||||
**Confidence:** High | Medium | Low — <why; if < High, state the exact SME question>
|
||||
|
||||
@@ -1,42 +1,14 @@
|
||||
---
|
||||
description: Security vulnerability scan with a reviewable remediation patch — OWASP, CWE, CVE, secrets, injection
|
||||
argument-hint: <system-dir> [--show-secrets]
|
||||
argument-hint: <system-dir>
|
||||
---
|
||||
|
||||
Run a **security hardening pass** on the legacy system: find
|
||||
vulnerabilities, rank them, and produce a reviewable patch for the
|
||||
critical ones. Parse arguments flag-independently: the system dir
|
||||
(referred to as `$1` below) is the first non-flag token in `$ARGUMENTS`;
|
||||
`--show-secrets` may appear anywhere.
|
||||
Run a **security hardening pass** on `legacy/$1`: find vulnerabilities, rank
|
||||
them, and produce a reviewable patch for the critical ones.
|
||||
|
||||
This command never edits `legacy/` — it writes findings and a proposed patch
|
||||
to `analysis/$1/`. The user reviews and applies (or not).
|
||||
|
||||
## Step 0 — Secrets quarantine setup
|
||||
|
||||
Findings files get shared, committed, and pasted into decks — discovered
|
||||
credential values must never land in them. Before any scanning:
|
||||
|
||||
1. Ensure `analysis/.gitignore` exists and contains the lines
|
||||
`SECRETS.local.md` and `*.local.patch`. Create the file or append the
|
||||
missing lines.
|
||||
2. If the project is a git repo, verify with
|
||||
`git check-ignore -q analysis/$1/SECRETS.local.md` — if that exits
|
||||
non-zero, fix the ignore rule before proceeding. Do not write any
|
||||
findings until this check passes.
|
||||
3. **If there is no git repo** (check for `.svn`/`.hg`/`CVS` too — a
|
||||
`.gitignore` protects nothing under another VCS): refuse
|
||||
`--show-secrets`, and write `SECRETS.local.md` and any `.local.patch`
|
||||
file to `~/.modernize/$1/` instead of the project tree, telling the
|
||||
user where they went and why.
|
||||
|
||||
All secret values in every shareable artifact this command produces are
|
||||
**masked** (`AKIA****`, `password=****`) and cited by `file:line`. Raw
|
||||
values may appear in exactly two places, both gitignored: the
|
||||
`*.local.patch` remediation hunks (unavoidably — see Remediate) and, only
|
||||
with `--show-secrets`, `SECRETS.local.md`. Never in SECURITY_FINDINGS.md
|
||||
or patch commentary.
|
||||
|
||||
## Scan
|
||||
|
||||
Spawn the **security-auditor** subagent:
|
||||
@@ -48,9 +20,7 @@ hardcoded secrets, vulnerable dependency versions, missing input validation,
|
||||
path traversal. For each finding return: CWE ID, severity
|
||||
(Critical/High/Med/Low), file:line, one-sentence exploit scenario, and
|
||||
recommended fix. Run any available SAST tooling (npm audit, pip-audit,
|
||||
OWASP dependency-check) and include its raw output. Mask every discovered
|
||||
credential value per your secret-handling rules — file:line plus a 2–4
|
||||
character masked preview, never the value itself."
|
||||
OWASP dependency-check) and include its raw output."
|
||||
|
||||
## Triage
|
||||
|
||||
@@ -59,50 +29,26 @@ Write `analysis/$1/SECURITY_FINDINGS.md`:
|
||||
- Findings table sorted by severity
|
||||
- Dependency CVE table (package, installed version, CVE, fixed version)
|
||||
|
||||
If any hardcoded credentials were found, also write
|
||||
`analysis/$1/SECRETS.local.md` (the gitignored quarantine file from Step 0):
|
||||
one row per credential — masked preview, `file:line`, credential type, what
|
||||
it appears to grant access to, production/test guess, and a rotation
|
||||
recommendation. With `--show-secrets`, append the raw value column here —
|
||||
this file only. SECURITY_FINDINGS.md gets a one-line pointer:
|
||||
"N hardcoded credentials found — inventory in SECRETS.local.md (gitignored;
|
||||
not for sharing)."
|
||||
|
||||
## Remediate
|
||||
|
||||
For each **Critical** and **High** finding, draft a minimal, targeted fix.
|
||||
Do **not** edit `legacy/` — write fixes as unified diffs with **paths
|
||||
relative to the project root** (`legacy/$1/...`), applied from the project
|
||||
root, with a comment line above each hunk citing the finding ID it
|
||||
addresses (`# SEC-001: parameterize the query`).
|
||||
|
||||
**Credential findings split into two files.** A diff that removes a
|
||||
hardcoded secret necessarily contains the raw value on its `-` and
|
||||
context lines — that cannot go in the shareable patch:
|
||||
|
||||
- `analysis/$1/security_remediation.patch` (shareable) — every
|
||||
non-credential hunk, plus for each credential finding a comment-only
|
||||
placeholder: `# SEC-NNN: credential remediation — hunk in
|
||||
security_remediation.local.patch (gitignored; not for sharing)`.
|
||||
- `analysis/$1/security_remediation.local.patch` (gitignored in Step 0) —
|
||||
the real, applyable hunks for credential findings only.
|
||||
Do **not** edit `legacy/` — write all fixes as a single unified diff to
|
||||
`analysis/$1/security_remediation.patch`, with a comment line above each
|
||||
hunk citing the finding ID it addresses (`# SEC-001: parameterize the query`).
|
||||
|
||||
Add a **Remediation Log** section to SECURITY_FINDINGS.md mapping each
|
||||
finding ID → one-line summary of the proposed fix and which patch file
|
||||
carries the hunk.
|
||||
finding ID → one-line summary of the proposed fix and the patch hunk that
|
||||
implements it.
|
||||
|
||||
## Verify
|
||||
|
||||
Spawn the **security-auditor** again to **review both patches** against
|
||||
the original code:
|
||||
Spawn the **security-auditor** again to **review the patch** against the
|
||||
original code:
|
||||
|
||||
"Review analysis/$1/security_remediation.patch and
|
||||
analysis/$1/security_remediation.local.patch against legacy/$1. For each
|
||||
"Review analysis/$1/security_remediation.patch against legacy/$1. For each
|
||||
hunk: does it fully remediate the cited finding? Does it introduce new
|
||||
vulnerabilities or change behavior beyond the fix? Confirm no raw
|
||||
credential values appear anywhere in the shareable patch. Return one
|
||||
verdict per hunk: RESOLVES / PARTIAL / INTRODUCES-RISK, with a one-line
|
||||
reason."
|
||||
vulnerabilities or change behavior beyond the fix? Return one verdict per
|
||||
hunk: RESOLVES / PARTIAL / INTRODUCES-RISK, with a one-line reason."
|
||||
|
||||
Add a **Patch Review** section to SECURITY_FINDINGS.md with the verdicts.
|
||||
If any hunk is PARTIAL or INTRODUCES-RISK, revise the patch and re-review.
|
||||
@@ -111,12 +57,8 @@ If any hunk is PARTIAL or INTRODUCES-RISK, revise the patch and re-review.
|
||||
|
||||
Tell the user the artifacts are ready:
|
||||
- `analysis/$1/SECURITY_FINDINGS.md` — findings, remediation log, patch review
|
||||
- `analysis/$1/security_remediation.patch` — review, then apply **from the
|
||||
project root**: `git apply analysis/$1/security_remediation.patch`
|
||||
(if `legacy/$1` is a symlink, use `git apply --unsafe-paths` or apply
|
||||
with `patch -p0` from the project root)
|
||||
- `analysis/$1/security_remediation.local.patch` — the credential fixes;
|
||||
apply the same way, and rotate the affected credentials regardless
|
||||
- `analysis/$1/security_remediation.patch` — review, then apply if appropriate
|
||||
with `git -C legacy/$1 apply ../../analysis/$1/security_remediation.patch`
|
||||
- Re-run `/modernize-harden $1` after applying to confirm resolution
|
||||
|
||||
Suggest: `glow -p analysis/$1/SECURITY_FINDINGS.md`
|
||||
|
||||
Reference in New Issue
Block a user