mirror of
https://github.com/alirezarezvani/claude-skills.git
synced 2026-10-11 03:37:58 +00:00
d4ea125c2f
Security scanners legitimately reference dangerous patterns (eval, os.system, subprocess shell=True, etc.) inside their own regex pattern definitions and human-readable risk/fix descriptions. Auditing the auditor itself produced 17 CRITICAL false positives — all from its own pattern table. ship-gate had the same issue (2 CRITICALs on a check description and a variable name called eval_findings). Fix: - Add 'noqa: SEC-AUDITOR' / 'auditor:ignore-line' line-suppression directive to all three scan loops (code patterns, prompt-injection markdown, pip/npm runtime install detection). - Annotate the 179 pattern-definition lines in skill_security_auditor.py (regex, risk, fix entries) and 4 cleanup shutil.rmtree calls. - Annotate ship-gate's two flagged lines (SEC-13 check description and eval_findings variable usage). - Annotate SKILL.md and references/threat-model.md tables that document attack patterns for human readers (HTML comment <!-- noqa: SEC-AUDITOR -->). Verified end-to-end: skill-security-auditor self-audit: 17 CRITICAL -> 0 (PASS) ship-gate self-audit: 2 CRITICAL -> 0 (PASS) slo-architect: PASS (0/0) project-management WARN unchanged (no top-level SKILL.md, expected) |
||
|---|---|---|
| .. | ||
| .claude-plugin | ||
| .codex | ||
| agenthub | ||
| autoresearch-agent | ||
| behuman | ||
| chaos-engineering | ||
| code-tour | ||
| data-quality-auditor | ||
| demo-video | ||
| docker-development | ||
| feature-flags-architect | ||
| helm-chart-builder | ||
| karpathy-coder | ||
| kubernetes-operator | ||
| llm-cost-optimizer | ||
| llm-wiki | ||
| prompt-governance | ||
| skills | ||
| slo-architect | ||
| statistical-analyst | ||
| terraform-patterns | ||