camdnn/security-skills

A Claude plugin of security Agent Skills that finds vulnerabilities in a codebase, shows where they are and how they trace back to entry points and business rules, ranks them by risk, and can fix them using test-driven development.
Team: Curren Sebastian · Camden Mann Track: System or Tool Design
## Goal
AI coding tools write more and more production code, and that code is often insecure. Developers rarely prompt for security. This plugin adds a security layer to AI-assisted development that:
1. Understands what the program is supposed to do (business rules, intent, architecture)
2. Finds vulnerabilities and explains where they are, why they exist, and how they trace back to the source
3. Prioritizes them with a DREAD risk score (1–5)
4. Fixes them on request, with a test that proves each vulnerability was real and is now gone
Accuracy is measured, not assumed: an automated checker scores every change against known-vulnerable apps (OWASP Juice Shop, NodeGoat).
## Intended Users
| User | Use |
| Developers using AI coding tools | Check AI-generated code before it ships |
| Small teams without a security engineer | A first-pass security review with explanations |
| Students and learners | Learn why code is vulnerable and how secure fixes look |
| Reviewers | A ranked, traceable list of findings to focus a code review |
Initial scope: Node.js / TypeScript + Express web applications.
## How It Works
1. /analyzer:security-context manual · read-only
Explores the code, interviews the developer (each question has a recommended
answer), and writes context docs + a plan to docs/security/.
2. /analyzer:security-scan manual · read-only
Uses the context if present (or offers to build it), runs the relevant checks,
and reports every finding with location, trace, DREAD score, and suggested fix.
/analyzer:secure-coding-guide optional · manual
Turns scan results into secure-coding rules for this project.
3. /analyzer:implement manual · opt-in · the only step that changes code
Fixes chosen findings with TDD on a separate branch.
## Skills
### Workflow
| Skill | What it does |
| security-context | Builds a security model of the program: roles, permissions, business rules, developer intent, architecture, and module contracts. Saves the developer's answers and a recommended plan. Never modifies code. |
| security-scan | Orchestrator. Loads the context (warns if stale), starts from entry points, runs checks per module, merges and deduplicates findings, ranks by DREAD, and writes SCAN-REPORT.md + findings.json. Works without context, at lower confidence for business-logic flaws. |
| secure-coding-guide | Optional. Reads the scan results and writes secure defaults for the patterns this project got wrong, so the same bugs aren't reintroduced. |
| implement | Opt-in. For each chosen finding: writes a test that exploits it (must fail), applies the smallest fix (test passes), runs the full suite, and re-scans to confirm the finding is gone. Untestable findings are flagged for human review. |
### Checks (run by security-scan, or individually)
| Skill | Finds | DREAD (1–5) |
| secrets-check | Hardcoded API keys, passwords, tokens, private keys | 4.8 |