v0.5.3

Web App Security Skill v0.5.3

Web App Security Skill gives Web builders using AI coding agents a reviewable local security first pass. Run it without installing:

npx --yes web-app-security-skill@0.5.3 audit . --fail-on never

The report explains each lead in security terms and ordinary language, states what the evidence
does not prove, proposes a change for review, names likely product side effects, and separates
security retesting from normal-behavior testing. The command does not edit the project or contact
a deployment.

v0.5.3 also includes the Claude repository plugin, diff-scoped review, the planted pattern
benchmark and public known limitations. These are bounded first-pass capabilities; they do not
prove that a project is secure or establish production-vulnerability precision or recall.

---

Release identity

• Version/tag: v0.5.3
• Source identity: the commit peeled from the SSH-signed annotated tag; the exact commit is recorded
  in web-app-security-skill-0.5.3.release.json and the provenance attestation.
• Runtime matrix: Node.js 22 and 24 on Ubuntu and macOS; Bash 3.2 remains covered on macOS.
• Stable corpus: 20 built-in risk rules, two evidence-integrity rules and eight opt-in external
  adapter rules, unchanged from v0.5.2.

This file is part of the source commit it describes and therefore does not embed a fabricated self-
referential source SHA. The signed tag, manifest and provenance establish the published source
identity.

Distribution

The package named web-app-security-skill publishes the real zero-dependency CLI with both
web-app-security-skill and webapp-security bin names. Its explicit file allowlist contains the
runtime, skill instructions, rules, schemas, references, current limitations and benchmark evidence
while excluding repository tests, launch/adoption notes and engineering plans. An isolated packed
artifact runs version and a real source audit through offline npx.

Claude Code can add this repository as marketplace web-app-security and install plugin
web-app-security-skill. The plugin uses the repository-root SKILL.md; no copied detector or
second skill body exists. Both manifests validate with Claude Code 2.1.284, and an isolated Claude
configuration completes marketplace add, plugin install and plugin listing.

Git diff source selection

audit <project> --since <ref> resolves the ref to an immutable commit, scans current tracked source
with full file context and retains exact-location findings on added lines. It records but excludes
untracked files. audit <project> --staged exports and scans the Git index, excluding unstaged
working-tree content.

Path-level findings follow materially changed files. Missing-lockfile conclusions remain visible
when a relevant manifest, workspace file or ancestor lockfile changes. Changed-file parse failures
and global traversal incompleteness remain explicit unknown evidence. Pure content-identical renames
do not replay findings.

Diff modes use the built-in adapter only and cannot use baseline/retest comparison. A clean diff
report does not establish whole-repository safety.

Ground-truth pattern benchmark

npm run benchmark:ground-truth regenerates exact JSON and Markdown results from the stable corpus.
The 20 risk contracts produce TP=20, FN=0, TN=20 and FP=0; the two evidence-integrity contracts
produce TP=2, FN=0, TN=2 and FP=0, with no expected-state mismatch. Tests prove that deleting a
positive observation produces an FN and that a safe-neighbour match produces an FP.

These are synthetic planted pattern-contract results. They do not measure production-vulnerability
precision, recall, language coverage, reachability or exploitability. The five-project ordinary-code
review remains separate evidence.

Known limitations and deferred expansion

KNOWN_LIMITATIONS.md publishes current parser, evidence-state, external-adapter, incremental and
recurring benign-match boundaries. The v0.5.3 architecture decision defers MCP and additional stable
rules. It defines client demand, permission, schema, local transport, distribution and failure tests
for future MCP work, plus fixture, evidence-boundary, false-positive and fail-closed gates for every
future stable rule.

Compatibility and security boundary

• Finding/report v3, persisted-subject comparison and v2 migration semantics remain compatible.
• Syntax and external scanner matches remain suspected until independent evidence confirms them.
• Missing or failed source evidence remains unknown; unavailable evidence is never a pass.
• Passive network defaults, authorization acknowledgements and review-only repair behavior are
  unchanged.
• This release is not general SAST/DAST coverage, authenticated testing, an MCP service or proof that
  a project is secure.

Release verification

The release workflow runs npm run check, rebuilds all four release assets twice and compares every
byte, verifies archive structure, checksums, manifest and SPDX SBOM, exercises isolated install and
upgrade, then requests GitHub build provenance before publication.

Verify the signed tag:

git -c gpg.ssh.allowedSignersFile=.github/release-signers verify-tag v0.5.3

The published SHA256SUMS, manifest source commit, git rev-parse 'v0.5.3^{}', GitHub-recorded asset
digests and provenance are verified before immutable asset digests are added to the installer. npm,
verified installation and the mutable v1 alias are promoted only after their public consumers pass.