Assesses PopKit plugin security with automated secret and injection scans, vulnerability patterns, OWASP checklists, and risk scoring. Outputs JSON reports with severity and fixes.
From popkit-opsnpx claudepluginhub jrc1883/popkit-ai --plugin popkit-opsThis skill uses the workspace's default tool permissions.
checklists/injection-patterns.jsonchecklists/owasp-alignment.jsonchecklists/secret-detection.jsonscripts/calculate_risk.pyscripts/scan_injection.pyscripts/scan_secrets.pystandards/access-control.mdstandards/injection-prevention.mdstandards/input-validation.mdstandards/secret-patterns.mdDesigns and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Implements structured self-debugging workflow for AI agent failures: capture errors, diagnose patterns like loops or context overflow, apply contained recoveries, and generate introspection reports.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
Provides concrete, reproducible security assessment for PopKit plugins using:
python skills/pop-assessment-security/scripts/scan_secrets.py packages/plugin/
python skills/pop-assessment-security/scripts/scan_injection.py packages/plugin/
python skills/pop-assessment-security/scripts/calculate_risk.py packages/plugin/
Read and apply checklists in order:
checklists/secret-detection.json - Hardcoded credentialschecklists/injection-patterns.json - Command/path injectionchecklists/owasp-alignment.json - OWASP Top 10 mappingCombine automated findings with checklist results for final security report.
| Standard | File | Key Checks |
|---|---|---|
| Secret Detection | standards/secret-patterns.md | SD-001 through SD-010 |
| Injection Prevention | standards/injection-prevention.md | IP-001 through IP-008 |
| Access Control | standards/access-control.md | AC-001 through AC-006 |
| Input Validation | standards/input-validation.md | IV-001 through IV-008 |
| Level | Score | Description | Action |
|---|---|---|---|
| Critical | 9-10 | Immediately exploitable | Block release |
| High | 7-8 | Likely exploitable | Must fix |
| Medium | 4-6 | Conditionally exploitable | Should fix |
| Low | 1-3 | Minor risk | Consider fixing |
| Info | 0 | Best practice | Optional |
Returns JSON with:
risk_score: 0-100 (higher = more risk)vulnerabilities: List with severity, location, CWEpassed_checks: Security controls that passedrecommendations: Prioritized fix list