From sdk-lifecycle
Perform comprehensive security review of SDK projects including dependency scanning, OWASP checklist, and vulnerability management
npx claudepluginhub infiquetra/infiquetra-claude-plugins --plugin sdk-lifecycleThis skill uses the workspace's default tool permissions.
You are helping the user perform a comprehensive security review of their SDK project.
Provides Ktor server patterns for routing DSL, plugins (auth, CORS, serialization), Koin DI, WebSockets, services, and testApplication testing.
Conducts multi-source web research with firecrawl and exa MCPs: searches, scrapes pages, synthesizes cited reports. For deep dives, competitive analysis, tech evaluations, or due diligence.
Provides demand forecasting, safety stock optimization, replenishment planning, and promotional lift estimation for multi-location retailers managing 300-800 SKUs.
You are helping the user perform a comprehensive security review of their SDK project.
The sdk-security-review skill provides:
Before conducting security review, verify:
Use the security_audit.py script:
python plugins/sdk-lifecycle/skills/sdk-security-review/scripts/security_audit.py \
--project-path "path/to/sdk" \
--language "python|dotnet|typescript" \
--report-format "json|html|markdown"
The script will:
Validate the SDK against OWASP Top 10 for SDKs:
# Install security tools
pip install safety bandit pip-audit
# Scan dependencies
safety check --json
pip-audit --desc
# Code security scan
bandit -r src/ -f json -o bandit-report.json
# Check for outdated packages
pip list --outdated
Common Python vulnerabilities:
# Scan dependencies
dotnet list package --vulnerable --include-transitive
# Check for outdated packages
dotnet list package --outdated
# Use security analyzers
dotnet add package Microsoft.CodeAnalysis.NetAnalyzers
dotnet build /p:RunAnalyzers=true
Common .NET vulnerabilities:
# Scan dependencies
npm audit --json
npm audit fix
# Use Snyk for deeper analysis
npx snyk test
# Check for outdated packages
npm outdated
Common TypeScript vulnerabilities:
The security audit script generates a scorecard:
Infiquetra SDK Security Scorecard
============================
Project: my-sdk
Language: Python
Scan Date: 2026-02-11
Vulnerability Summary
---------------------
Critical: 0
High: 1
Medium: 3
Low: 5
Info: 2
Dependency Status
-----------------
Total Dependencies: 15
Outdated: 3
Vulnerable: 1
License Issues: 0
OWASP Checklist Compliance
--------------------------
Input Validation: ✓ PASS
Output Encoding: ✓ PASS
Authentication: ⚠ WARNING (API key in example code)
Sensitive Data: ✓ PASS
Error Handling: ✓ PASS
Cryptography: ✓ PASS
Configuration: ✓ PASS
Dependencies: ✗ FAIL (1 vulnerable dependency)
Rate Limiting: ✓ PASS
Logging: ✓ PASS
Overall Score: 85/100 (B)
Critical Actions Required
-------------------------
1. Update httpx to >= 0.27.2 (CVE-2024-XXXX)
2. Remove hardcoded API key from examples/quickstart.py
3. Update outdated dependencies (see details below)
Recommendations
---------------
- Add security.md file with vulnerability reporting process
- Implement automated dependency scanning in CI/CD
- Add pre-commit hooks for secret detection
- Consider adding rate limiting to client
For each finding, the report includes:
Example: Vulnerable Dependency
Finding: httpx 0.26.0 has known vulnerability CVE-2024-XXXX
Severity: HIGH
Impact: Potential for SSRF attacks
Remediation:
1. Update pyproject.toml: httpx>=0.27.2
2. Run: pip install --upgrade httpx
3. Test SDK functionality after upgrade
4. Update CHANGELOG.md with security fix
Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-XXXX
Detection:
# Use truffleHog or git-secrets
trufflehog filesystem src/
Remediation:
Detection: Language-specific tools (safety, npm audit, dotnet list package --vulnerable)
Remediation:
Detection: Code review and testing with invalid inputs
Remediation:
Detection:
# Search for potential secret logging
grep -r "logger.*api_key" src/
grep -r "print.*password" src/
Remediation:
# Good: Secure by default
def __init__(self, api_key: str, verify_ssl: bool = True):
self.verify_ssl = verify_ssl # Default to True
# Bad: Insecure default
def __init__(self, api_key: str, verify_ssl: bool = False):
self.verify_ssl = verify_ssl # Default to False is dangerous
# Always validate certificates
async def _make_request(self, url: str):
async with httpx.AsyncClient(verify=True) as client:
response = await client.get(url)
# Always set timeouts
client = httpx.AsyncClient(timeout=30.0) # Prevent hanging requests
def __repr__(self):
# Redact sensitive fields
return f"Client(base_url={self.base_url}, api_key=***)"
from asyncio import Semaphore
class Client:
def __init__(self, max_concurrent=10):
self._semaphore = Semaphore(max_concurrent)
async def _make_request(self, url: str):
async with self._semaphore:
# Make request with concurrency limit
pass
Add security scanning to GitHub Actions:
name: Security Scan
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run dependency scan
run: |
python plugins/sdk-lifecycle/skills/sdk-security-review/scripts/security_audit.py \
--project-path . \
--fail-on critical,high
- name: Upload security report
uses: actions/upload-artifact@v4
with:
name: security-report
path: security-report.html
Create SECURITY.md in repository root:
# Security Policy
## Supported Versions
| Version | Supported |
| ------- | ------------------ |
| 1.x.x | :white_check_mark: |
| 0.x.x | :x: |
## Reporting a Vulnerability
**Please do not report security vulnerabilities through public GitHub issues.**
Email: user@example.com
Include:
- Description of vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if available)
Response time: 48 hours
## Security Update Process
1. Vulnerability assessed within 48 hours
2. Fix developed and tested
3. Security advisory published
4. Patch release issued
5. Users notified via GitHub Security Advisories
After security review:
For detailed security guidelines, see:
references/security-checklist.md - Complete OWASP security checklistreferences/dependency-scanning.md - Tool setup and automationreferences/vulnerability-management.md - Process for handling findings