claude-security-skills 1.1.0

Six issues from the backlog, all with tests. 227 tests pass, still no runtime dependencies.

secret-scanner knows the model providers now

A repo of AI-security skills that missed AI provider keys was an odd gap:

• Hugging Face (hf_), Replicate (r8_) and Groq (gsk_) have distinctive prefixes, so they match on shape alone.
• Cohere keys are 40 plain alphanumerics with nothing to anchor on, so that rule needs the word cohere nearby and stays entropy-gated. Without that it would fire on every long random string in a repository.
• DigitalOcean personal access tokens (dop_v1_ plus 64 hex), which do not fire on an ordinary hex digest of the same length.

sast-lite flags random used for secrets

random.choice for a token is CWE-330, and the fix is the secrets module. The rule only fires when the value is assigned to something that reads like a credential (token, password, otp, nonce, salt). Flagging every call would have buried the finding under sampling and shuffling.

http-sec-audit --advisory

Cross-origin isolation (COOP, COEP, CORP) and a missing Cache-Control, off by default on purpose. Since 1.0 the exit code reflects whatever the run reports, so an always-on check for headers that most sites have good reason not to set would turn every such site into a failed build. The findings are info severity and appear only when you ask for them.

Breaking: sast-lite now starts at info

--min-severity defaulted to low in sast-lite and to info in the other four engines, so one pipeline filtered differently depending on the skill. They all start at info now.

In practice sast-lite reports unparseable files where it used to skip them in silence, and a reported finding fails the run. A repository containing a file sast-lite cannot parse will start failing CI. Pass --min-severity low for the old behaviour.

---

Closes #42, #33, #34, #36, #37, #48. Full notes in CHANGELOG.md.

/plugin marketplace add NovaCode37/claude-security-skills
/plugin install claude-security-skills

claude-security-skills 1.0.0

First tagged release. Eight security skills for Claude Code, installable as a plugin.

Install

/plugin marketplace add NovaCode37/claude-security-skills
/plugin install claude-security-skills

All eight arrive together and update with the marketplace. Copying them into .claude/skills/ by hand still works and is still documented.

What's in it

Skill	What it does
secret-scanner	Hardcoded API keys, tokens and private keys, using vendor patterns alongside Shannon-entropy analysis
sast-lite	Python static analysis over the AST: command injection, eval/exec, insecure deserialization, SQLi, weak crypto, disabled TLS — each with a CWE
prompt-injection-tester	Red-teams your own LLM app against a categorized payload library with canary detection, scores resilience 0–100
http-sec-audit	HTTP security headers and cookie flags, with the specific fix for each
jwt-inspector	Decodes and audits JWTs, and cracks weak HMAC secrets offline
dependency-check	Vulnerable and unpinned dependencies in requirements.txt, package.json and pyproject.toml
dockerfile-scan	Root user, :latest base images, curl | sh, remote ADD, baked-in secrets
cors-auditor	Wildcard with credentials, reflected origins, null origin, overly broad methods

Ask Claude in plain language — "any secrets committed in here?", "is my CORS safe?" — and it picks the skill, runs it and explains the result. Every engine also runs standalone from the command line with --json.

How it is built

No runtime dependencies. Everything is Python 3.9+ standard library, so the skills run in locked-down CI and are short enough to read before you trust them. The analysis is offline; only the skills that need a URL touch the network, and only when asked.

Consistent exit codes across all eight — 0 clean, 1 findings, 2 error — so any of them works as a CI step. Secrets are redacted in output.

158 tests, all offline, under a second.

Contributing

Thanks to @ded-furby and @YuuGR1337, whose pull requests are in this release.

There are open issues tagged good first issue, each naming the file to edit and what has to pass. Adding a detection rule is a genuinely small change — several of the rules here arrived that way.

Legal

For authorized security testing, learning and defensive work. Scan only what you own or have permission to test.