w-security

Name: w-security
Author: blockmatic

Review the change or tree against repository security docs and existing checks.

by blockmatic(0) 0 installs

Free

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Imported from blockmatic/basilic-skills (skills/w-security/SKILL.md) via skills.sh. Install upstream with npx skills add blockmatic/basilic-skills --skill w-security. Copyright stays with the author.

Find security defects relative to repository security docs and existing scanners. Do not invent CORS, encryption, password, or header policy. Stay report-only unless the user asked to fix.

Read the repository security docs. If missing, stop and ask; do not invent a bar.
Spawn 2–3 read-only explorers on authn/authz, secret/exposure, and input validation for the changed paths. Reconcile trigger and consequence yourself.
Validate each suspected issue with a trigger and consequence. Skip invented CVEs and timings.
If authorized, run existing security scripts or CI jobs from the docs or package.json. Record passed, failed, or not run.
If fixes are authorized, change the owning cause. Policy changes need a human. Docs: /w-docs if behavior or commands changed.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot
curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

blockmatic-basilic-skills-w-security.ocm.jsonjson

{
  "ocm": "1",
  "id": "blockmatic-basilic-skills-w-security",
  "kind": "skill",
  "name": "w-security",
  "description": "Review the change or tree against repository security docs and existing checks.",
  "publisher": "blockmatic",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Review the change or tree against repository security docs and existing checks."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/blockmatic/basilic-skills",
      "path": "skills/w-security/SKILL.md",
      "ref": "HEAD",
      "url": "https://www.skills.sh/blockmatic/basilic-skills/w-security",
      "key": "blockmatic/basilic-skills/skills/w-security/SKILL.md"
    }
  },
  "instructions": "Find security defects relative to repository security docs and existing scanners. Do not invent CORS, encryption, password, or header policy. Stay report-only unless the user asked to fix.\n\n1. Read the repository security docs. If missing, stop and ask; do not invent a bar.\n2. Spawn 2–3 read-only explorers on authn/authz, secret/exposure, and input validation for the changed paths. Reconcile trigger and consequence yourself.\n3. Validate each suspected issue with a trigger and consequence. Skip invented CVEs and timings.\n4. If authorized, run existing security scripts or CI jobs from the docs o",
  "cost": {
    "context_tokens": 195
  }
}

Fetch it by URL: GET /api/v1/registry/blockmatic-basilic-skills-w-security/manifest?version=1.0.0

About

Use it

Manifest

Reviews