jorekai-security

Plugin jorekai-security from marketplace jorekai in jorekai/skills. Commands read from the repo's manifest — 20 days ago.

Skills (9)

• and-now

  Where a repository stands in the security loop and what comes next, read from the workspace files alone via scripts/status.py: rows past their verify date, open findings from the newest audit, rows naming an id this theme does not own, a review that wrote no rule, proposals without a decision, and u

• deps

  Which installed dependency carries a published advisory and which one is already being exploited, in one pass via scripts/deps.py: the lock files resolved to versions, then the advisory database, the catalogue of exploited flaws, and the exploitation probability. Also names a manifest with nothing t

• grade

  Check whether logged security fixes held, using the latest audit from the tool that found each issue. Write won, no-change, or returned. Use when a review date is due or overdue, during the weekly pass, or when asked whether a security fix worked.

• pipeline

  What the forge runs with this repository's own rights, in one pass via scripts/pipeline.py: a privileged trigger that checks out code from a fork, a shell step that puts a value from outside straight into the command line, a workflow that names no rights for its token or grants a broad one, a third-

• report

  Write the monthly security report from the workspace. Compare costs at the start and end of the month. List action results, risk classes, and open issues by priority, then name three next steps.

• review

  Trace attacker-controlled input from documented entry points to dangerous operations. Check injection, authorization, deserialization, outgoing requests, cryptography, and data in logs or responses. Verify each finding against the code and save a rule to check it again later. Use for code or pull re

• secrets

  Credentials in the files a repository tracks and in the history behind them, in one pass via scripts/secrets.py: a value in a tracked file, a value still reachable through the history where the file no longer carries it, and a value this pass found that carries no rotation date. Use when asked wheth

• security

  Choose the next security skill for a new repository, a weekly sweep, or a leaked credential. Explains priorities, safeguards before each fix, and how to measure its result.

• setup

  Take a repository into the security workspace: detect the ecosystem, write the trust model that says which input an attacker controls and what already mitigates, record the secret store and the way a credential is rotated, choose the profile that sets the bar, and measure once.

Similar plugins