Validates PopKit security posture using concrete vulnerability patterns, automated secret scanning, and OWASP-aligned checklists
/plugin marketplace add jrc1883/popkit-claude/plugin install popkit@popkit-marketplaceThis skill inherits all available tools. When active, it can use any tool Claude has access to.
checklists/injection-patterns.jsonchecklists/owasp-alignment.jsonchecklists/secret-detection.jsonscripts/calculate_risk.pyscripts/scan_injection.pyscripts/scan_secrets.pystandards/access-control.mdstandards/injection-prevention.mdstandards/input-validation.mdstandards/secret-patterns.mdProvides concrete, reproducible security assessment for PopKit plugins using:
python skills/pop-assessment-security/scripts/scan_secrets.py packages/plugin/
python skills/pop-assessment-security/scripts/scan_injection.py packages/plugin/
python skills/pop-assessment-security/scripts/calculate_risk.py packages/plugin/
Read and apply checklists in order:
checklists/secret-detection.json - Hardcoded credentialschecklists/injection-patterns.json - Command/path injectionchecklists/owasp-alignment.json - OWASP Top 10 mappingCombine automated findings with checklist results for final security report.
| Standard | File | Key Checks |
|---|---|---|
| Secret Detection | standards/secret-patterns.md | SD-001 through SD-010 |
| Injection Prevention | standards/injection-prevention.md | IP-001 through IP-008 |
| Access Control | standards/access-control.md | AC-001 through AC-006 |
| Input Validation | standards/input-validation.md | IV-001 through IV-008 |
| Level | Score | Description | Action |
|---|---|---|---|
| Critical | 9-10 | Immediately exploitable | Block release |
| High | 7-8 | Likely exploitable | Must fix |
| Medium | 4-6 | Conditionally exploitable | Should fix |
| Low | 1-3 | Minor risk | Consider fixing |
| Info | 0 | Best practice | Optional |
Returns JSON with:
risk_score: 0-100 (higher = more risk)vulnerabilities: List with severity, location, CWEpassed_checks: Security controls that passedrecommendations: Prioritized fix listThis skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.