diff options
| author | Craig Jennings <c@cjennings.net> | 2026-05-06 21:59:52 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-05-06 21:59:52 -0500 |
| commit | 5710b7865549b923467f5e4b1056e040273fc6aa (patch) | |
| tree | 33a87e2f8a21c2d2d24434340c100f70a895c757 /.claude/commands/security-check.md | |
| parent | aa77f41ff803304c2bc6f224185e1247088a873e (diff) | |
| download | rulesets-5710b7865549b923467f5e4b1056e040273fc6aa.tar.gz rulesets-5710b7865549b923467f5e4b1056e040273fc6aa.zip | |
chore(commands): mark user-invoked commands disable-model-invocation
Add disable-model-invocation: true to the user-triggered slash commands so the harness drops their descriptions from the model's preloaded skill listing while keeping /<name> routing intact. Skills meant for model recommendation (add-tests, debug, five-whys, frontend-design, humanizer, pairwise-tests, playwright-js, playwright-py, root-cause-trace) are unchanged.
Diffstat (limited to '.claude/commands/security-check.md')
| -rw-r--r-- | .claude/commands/security-check.md | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/.claude/commands/security-check.md b/.claude/commands/security-check.md index ca431e0..0880e99 100644 --- a/.claude/commands/security-check.md +++ b/.claude/commands/security-check.md @@ -1,3 +1,8 @@ +--- +description: Audit staged changes (or a specific file/directory) for security issues in three categories. Hardcoded secrets — AWS keys, `sk-`/`sk_live_`/`sk_test_` patterns, password/secret assignments, private-key blocks, `.env` contents, API tokens, JWTs, bearer tokens. OWASP top-10 — SQL injection via string concatenation, XSS via unsanitized rendering, missing permission checks, unsafe deserialization (`eval`/`exec` on untrusted data), debug-mode misconfigs, PII or tokens in logs. Dependency risks — runs `pip-audit` for Python diffs, `npm audit` for JS/TS diffs, flags new unpinned deps. Scope defaults to `git diff --cached`; falls back to the last commit if nothing's staged; an explicit path overrides. Reports findings in a severity-ranked table (CRITICAL/HIGH/MEDIUM/LOW/INFO) with file:line + recommendation per row, or a "no issues detected" verdict listing what was checked. Use before committing changes touching security-sensitive paths. Do NOT use for full-codebase audits (diff-scoped — see Claude Code's `/security-review` for branch-wide review), runtime/fuzzing analysis, or as a substitute for full-lockfile dependency scanning. +disable-model-invocation: true +--- + # /security-check — Audit Changes for Security Issues Scan staged or recent changes for secrets, OWASP vulnerabilities, and dependency risks. |