scriptoriumadmin/claude-skills
1
0
Fork 0
mirror of https://github.com/alirezarezvani/claude-skills.git synced 2026-10-11 03:37:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
claude-skills/engineering/skills
History
Claude d4ea125c2f
fix(skill-security-auditor): self-skip false positives via noqa directive 
Security scanners legitimately reference dangerous patterns (eval, os.system,
subprocess shell=True, etc.) inside their own regex pattern definitions and
human-readable risk/fix descriptions. Auditing the auditor itself produced
17 CRITICAL false positives — all from its own pattern table. ship-gate had
the same issue (2 CRITICALs on a check description and a variable name
called eval_findings).

Fix:
- Add 'noqa: SEC-AUDITOR' / 'auditor:ignore-line' line-suppression directive
  to all three scan loops (code patterns, prompt-injection markdown,
  pip/npm runtime install detection).
- Annotate the 179 pattern-definition lines in skill_security_auditor.py
  (regex, risk, fix entries) and 4 cleanup shutil.rmtree calls.
- Annotate ship-gate's two flagged lines (SEC-13 check description and
  eval_findings variable usage).
- Annotate SKILL.md and references/threat-model.md tables that document
  attack patterns for human readers (HTML comment <!-- noqa: SEC-AUDITOR -->).

Verified end-to-end:
  skill-security-auditor self-audit: 17 CRITICAL -> 0 (PASS)
  ship-gate self-audit: 2 CRITICAL -> 0 (PASS)
  slo-architect: PASS (0/0)
  project-management WARN unchanged (no top-level SKILL.md, expected)
2026-05-10 07:21:24 +00:00
..
agent-designer fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
agent-workflow-designer fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
api-design-reviewer fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
api-test-suite-builder fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
browser-automation fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
changelog-generator fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
chaos-engineering feat(skills): ship chaos-engineering (Phase 3 — resilience testing discipline) 2026-05-09 21:24:16 +00:00
ci-cd-pipeline-builder fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
codebase-onboarding fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
command-guide fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
database-designer fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
database-schema-designer fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
dependency-auditor fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
engineering-advanced-skills fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
env-secrets-manager fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
feature-flags-architect feat(skills): ship feature-flags-architect (Phase 1 pilot — dual-publish) 2026-05-09 06:10:43 +00:00
focused-fix fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
full-page-screenshot fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
git-worktree-manager fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
interview-system-designer fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
kubernetes-operator feat(skills): ship kubernetes-operator (Phase 2 — operator pattern discipline) 2026-05-09 09:01:45 +00:00
mcp-server-builder fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
migration-architect fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
monorepo-navigator fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
observability-designer fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
performance-profiler fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
pr-review-expert fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
rag-architect fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
release-manager fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
runbook-generator fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
secrets-vault-manager fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
self-eval fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
ship-gate fix(skill-security-auditor): self-skip false positives via noqa directive 2026-05-10 07:21:24 +00:00
skill-security-auditor fix(skill-security-auditor): self-skip false positives via noqa directive 2026-05-10 07:21:24 +00:00
skill-tester fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
slo-architect feat(slo-architect): Phase 4 — SLO/SLI/error-budget discipline (#605) 2026-05-10 07:39:05 +02:00
spec-driven-workflow fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
sql-database-assistant fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
tc-tracker fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00
tech-debt-tracker fix(plugins): restructure 9 multi-skill domain plugins into ./skills/ layout 2026-05-02 22:51:20 +02:00