secure-agent-boundaries

Plugin secure-agent-boundaries from marketplace youdede-toolkit in youdede/toolkit. Commands read from the repo's manifest — today.

Skills (2)

• author-mcp-server-contract

  Design or review an MCP server’s resources, prompts, tools, schemas, transport, authentication, pagination, errors, and authority boundaries before implementation. Use when exposing a real system to coding agents through the Model Context Protocol.

• review-agent-tool-boundaries

  Review an agent, MCP server, plugin, or tool workflow for prompt-injection paths, identity propagation, least privilege, data exposure, confirmation, and failure safety. Use before granting an agent access to real systems or expanding tool permissions.

Subagents (2)

• application-security-reviewer

  Fallback umbrella review of a change or a set of paths whose source-to-sink path crosses two or more application-security boundaries, returning reachable risks. Use only when the path joins two or more of untrusted input, an identity decision, a parser, or a protected sink and no narrower specialist

• mcp-trust-boundary-reviewer

  Map an MCP server's tools, resources, prompts, transports, and credentials against their handler code and return paths where untrusted input reaches a capability or sensitive sink without adequate control. Use when the parent supplies MCP server source files, tool schemas, or transport and credentia

Hooks (5)

• PreToolUse

  node "${CLAUDE_PLUGIN_ROOT}/hooks/youdede/outbound-data-guard.mjs"

• PreToolUse

  node "${CLAUDE_PLUGIN_ROOT}/hooks/youdede/sensitive-file-access-guard.mjs"

• PreToolUse

  node "${CLAUDE_PLUGIN_ROOT}/hooks/youdede/mcp-capability-drift-guard.mjs"

• PreToolUse

  node "${CLAUDE_PLUGIN_ROOT}/hooks/youdede/mcp-egress-guard.mjs"

• PreToolUse

  node "${CLAUDE_PLUGIN_ROOT}/hooks/youdede/shell-command-guard.mjs"