Name: secure-change
Author: metapak

Imported from metapak/claude-bounded-orchestrator (.claude/skills/secure-change/SKILL.md). Install upstream with npx skills add metapak/claude-bounded-orchestrator --skill secure-change. Copyright stays with the author.

Security expertise

Use this skill only when explicitly invoked for the current task.

Have the assigned specialist identify assets, trust boundaries, actors, inputs, outputs, and durable side effects in scope. The main session coordinates from its short evidence report.
Check authorization at the action boundary, not only in the interface.
Validate untrusted input, escape output for its destination, and avoid exposing secrets or personal data.
Prefer least privilege, safe defaults, explicit failure, and auditable behavior.
Have the assigned specialist test the highest-risk abuse case and return short evidence without secrets or raw logs.
Stop for owner direction before changing authentication, authorization, encryption, permissions, billing, or data retention.

This skill supplies guidance only. It does not grant tools, file access, external access, or permission to edit.

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Install secure-change and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "metapak-claude-bounded-orchestrator-secure-change", "kind": "skill", "name": "secure-change", "description": "Applies a focused security review checklist when the user or owner explicitly requests security expertise.", "publisher": "metapak", "version": "1.0.0", "capabilities": { "domains": [ "observability" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Applies a focused security review checklist when the user or owner explicitly requests security expertise." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/metapak/claude-bounded-orchestrator", "path": ".claude/skills/secure-change/SKILL.md", "ref": "981a7a9a5a35775dedcdaafd14434f7ca561567f", "url": "https://github.com/metapak/claude-bounded-orchestrator/blob/981a7a9a5a35775dedcdaafd14434f7ca561567f/.claude/skills/secure-change/SKILL.md", "key": "metapak/claude-bounded-orchestrator/.claude/skills/secure-change/SKILL.md" } }, "instructions": "# Security expertise\n\nUse this skill only when explicitly invoked for the current task.\n\n1. Have the assigned specialist identify assets, trust boundaries, actors, inputs, outputs, and durable side effects in scope. The main session coordinates from its short evidence report.\n2. Check authorization at the action boundary, not only in the interface.\n3. Validate untrusted input, escape output for its destination, and avoid exposing secrets or personal data.\n4. Prefer least privilege, safe defaults, explicit failure, and auditable behavior.\n5. Have the assigned specialist test the highest-risk ab", "cost": { "context_tokens": 226 } }

secure-change

About

Security expertise

Use it

Install secure-change and it becomes one more candidate the router can pick - when it fits.

Manifest

Reviews