From security
Indexes vulnerability detection patterns and routes to core universal skills for secrets, injections, configs plus language-specific for JavaScript/TypeScript, Python, Go, Java, Ruby, PHP.
npx claudepluginhub zate/cc-plugins --plugin securityThis skill uses the workspace's default tool permissions.
This skill is an index to modular detection pattern skills. Use the specialized skills for focused scanning.
Detects OWASP Top 10 2021 security vulnerabilities like broken access control and injection, with remediation patterns for audits and code reviews.
Identifies common web vulnerability patterns like SQL injection, command injection, XSS, and OWASP Top 10 during whitebox pentesting and code reviews.
Performs Static Application Security Testing (SAST) to detect vulnerabilities like SQL injection, XSS, hardcoded secrets, and path traversal in Python, JavaScript/TypeScript, Java, Ruby, PHP, Go, Rust codebases using Bandit, Semgrep, ESLint Security.
Share bugs, ideas, or general feedback.
This skill is an index to modular detection pattern skills. Use the specialized skills for focused scanning.
vuln-patterns-coreCovers: Universal patterns, configuration files, quick scan scripts Languages: All (cross-language patterns) Use when: Scanning any codebase, config audits, hook integration
Includes:
vuln-patterns-languagesCovers: Language-specific vulnerability patterns Languages: JavaScript/TypeScript, Python, Go, Java, Ruby, PHP Use when: Targeting specific tech stacks, code review
Includes:
| What You're Looking For | Skill to Use |
|---|---|
| Hardcoded secrets | vuln-patterns-core |
| SQL injection (any language) | vuln-patterns-core |
| Command injection (any) | vuln-patterns-core |
| Path traversal | vuln-patterns-core |
| Docker/config issues | vuln-patterns-core |
| JavaScript XSS | vuln-patterns-languages |
| Python pickle/yaml | vuln-patterns-languages |
| Java deserialization | vuln-patterns-languages |
| Go TLS issues | vuln-patterns-languages |
| Ruby Rails patterns | vuln-patterns-languages |
| PHP include/require | vuln-patterns-languages |
| OWASP 2021 | Skill | Key Patterns |
|---|---|---|
| A01 Access Control | Core + Languages | Path traversal, authorization |
| A02 Crypto Failures | Languages | MD5, SHA1, weak random |
| A03 Injection | Core | SQL, command, XSS |
| A05 Security Misconfig | Core | Debug mode, headers |
| A07 Auth Failures | Core | Hardcoded credentials |
| A08 Data Integrity | Languages | Deserialization |
For live security hooks, use vuln-patterns-core which includes:
asvs-requirements - Full ASVS requirement detailsremediation-library - Index to fix patternsremediation-injection - Injection fixesremediation-crypto - Cryptography fixes