Help us improve
Share bugs, ideas, or general feedback.
From popkit-ops
Validates PopKit plugin security posture with vulnerability patterns, automated secret and injection scanning, OWASP checklists, and risk scoring.
npx claudepluginhub jrc1883/popkit-ai --plugin popkit-opsHow this skill is triggered — by the user, by Claude, or both
Slash command
/popkit-ops:pop-assessment-securityThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Provides concrete, reproducible security assessment for PopKit plugins using:
Mandates invoking relevant skills via tools before any response in coding sessions. Covers access, priorities, and adaptations for Claude Code, Copilot CLI, Gemini CLI.
Share bugs, ideas, or general feedback.
Provides concrete, reproducible security assessment for PopKit plugins using:
python skills/pop-assessment-security/scripts/scan_secrets.py packages/plugin/
python skills/pop-assessment-security/scripts/scan_injection.py packages/plugin/
python skills/pop-assessment-security/scripts/calculate_risk.py packages/plugin/
Read and apply checklists in order:
checklists/secret-detection.json - Hardcoded credentialschecklists/injection-patterns.json - Command/path injectionchecklists/owasp-alignment.json - OWASP Top 10 mappingCombine automated findings with checklist results for final security report.
| Standard | File | Key Checks |
|---|---|---|
| Secret Detection | standards/secret-patterns.md | SD-001 through SD-010 |
| Injection Prevention | standards/injection-prevention.md | IP-001 through IP-008 |
| Access Control | standards/access-control.md | AC-001 through AC-006 |
| Input Validation | standards/input-validation.md | IV-001 through IV-008 |
| Level | Score | Description | Action |
|---|---|---|---|
| Critical | 9-10 | Immediately exploitable | Block release |
| High | 7-8 | Likely exploitable | Must fix |
| Medium | 4-6 | Conditionally exploitable | Should fix |
| Low | 1-3 | Minor risk | Consider fixing |
| Info | 0 | Best practice | Optional |
Returns JSON with:
risk_score: 0-100 (higher = more risk)vulnerabilities: List with severity, location, CWEpassed_checks: Security controls that passedrecommendations: Prioritized fix list