backbay-labs/cursor-plugin/skills/security-review
cursor-plugin/skills/security-review/SKILL.md
Security review for risky code changes
$ install --global
skillsauthnpx skillsauth add backbay-labs/clawdstrike cursor-plugin/skills/security-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 4, 2026, 4:54 AM97.2s1 file scanned
SKILL.md
- description:
- Security review for risky code changes
Security Review
<trigger> This skill activates when the user or conversation involves: - Multi-file edits touching security-sensitive paths (auth, config, credentials, .env, keys) - Shell commands that modify system state, install packages, or change permissions - New dependency additions or version changes - Changes to CI/CD, Docker, or infrastructure configuration - File writes to sensitive directories (/etc, ~/.ssh, ~/.aws, ~/.config) - File reads of sensitive paths (private keys, credential stores, token caches, certificate files) - Any content containing these keywords: "secret", "credential", "API key", "token", "password", "private key", "certificate", ".env", "auth", "permission" </trigger>Security Checklist
Before proceeding with risky actions, use the clawdstrike_check MCP tool to verify policy compliance:
- Pre-flight check: Call
clawdstrike_checkwith the action_type and target before executing - Secret scanning: Verify no secrets, API keys, or credentials are being written to files
- Dependency audit: For new dependencies, check for known vulnerabilities
- Permission scope: Ensure file operations stay within allowed paths
- Shell safety: Validate shell commands against the ShellCommandGuard policy
Action Type Mapping
Use these action_type values when calling clawdstrike_check:
| Scenario | action_type | target |
|----------|-------------|--------|
| Writing/reading files | file | Absolute file path |
| Running shell commands | shell | The command string |
| HTTP/network requests | egress | Domain or URL |
| Installing packages | shell | Install command |
| MCP tool invocation | mcp_tool | Tool name |
Response Guidelines
When this skill is active:
- Proactively call
clawdstrike_checkbefore file writes to sensitive paths - Flag potential security issues with severity levels (Critical/High/Medium/Low)
- Suggest safer alternatives when an action would be blocked by policy
- Reference specific guards that would evaluate the action
Recommended Tools
Use these MCP tools in order of priority when this skill activates:
| Tool | When to Use |
|------|-------------|
| clawdstrike_check | Before any file write, shell command, or egress -- the primary enforcement tool |
| clawdstrike_policy_eval | To test hypothetical actions without executing them -- use for planning |
| clawdstrike_policy_show | To understand which guards are active and what the current restrictions are |
| clawdstrike_scan | To audit all MCP server configs for misconfigurations before a review |
| clawdstrike_policy_lint | To validate policy YAML files for syntax/schema errors |
Guard Reference
These guards are evaluated during checks:
- ForbiddenPathGuard - Blocks access to sensitive filesystem paths
- PathAllowlistGuard - Enforces allowlist-based path access
- SecretLeakGuard - Detects secrets/credentials in file content
- ShellCommandGuard - Blocks dangerous shell commands
- EgressAllowlistGuard - Controls outbound network access
- PatchIntegrityGuard - Validates patch/diff safety
Related Skills
backbay-labs/hello-secure
testing
VerifiedTrustedCommunity
A simple skill demonstrating clawdstrike security
273SKILL.mdUpdated Apr 3, 2026
backbay-labs/examples/openclaw-plugin/skills/hello
tools
VerifiedTrustedCommunity
# Hello Skill A simple greeting skill that demonstrates secure agent operation. ## Description This skill allows the agent to greet users and perform basic file operations within the allowed workspace. ## Capabilities - Generate personalized greetings - Read files from the workspace - Write greeting logs to the output directory ## Usage Ask the agent: - "Say hello to Alice" - "Read the welcome message from data/welcome.txt" - "Log a greeting for Bob" ## Examples ### Basic Greeting **Us
273SKILL.mdUpdated Apr 3, 2026
backbay-labs/examples/bb-edr/skills/edr-triage
testing
VerifiedTrustedCommunity
# bb-edr: Triage Skill Use this skill to turn clawdstrike audit logs into an incident report and a minimal response plan. ## Inputs - `.hush/audit.jsonl` (JSONL) — clawdstrike audit events (allowed/denied, guard, reason). - `policy.yaml` — the active security policy. ## Task 1. Read and summarize the last ~50 audit events. 2. Focus on **denied** events first: - Group by `guard` (e.g., `forbidden_path`, `egress`, `patch_integrity`) - Identify likely intent (misconfiguration vs. suspici
273SKILL.mdUpdated Apr 3, 2026
backbay-labs/cursor-plugin/skills/threat-hunt
tools
VerifiedTrustedCommunity
Threat hunting and security event investigation
273SKILL.mdUpdated Apr 3, 2026