forge-security-review

Name: forge-security-review
Author: atlassian

102installs8forks

How to install forge-security-review?

atlassian/forge-skills/forge-security-review

$npx -y skills add atlassian/forge-skills --skill forge-security-review

Installs into the current project.

Summary

Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolati

Files · 1

View on GitHub

SKILL.md

1	# Forge Security Review
2
3	Runs a Forge-focused white-box security review and reports validated findings with exploitability, impact, evidence, and remediation guidance.
4
5	## Token-Efficient Default
6
7	Use manifest-driven routing by default to reduce token usage. Do not load every rule file up front.
8
9	## Rule Assets
10
11	The review rules are packaged with this skill under `assets/security-rules/`:
12
13	- Global baseline: `assets/security-rules/_global-forge.mdc`
14	- Category indexes: `assets/security-rules/forge-/_index-.mdc`
15	- Category deep checks: `assets/security-rules/forge-/.mdc`
16
17	## Execution Mandate
18
19	When this skill is triggered:
20
21	1. Run static analysis first from this skill directory:
22	- `scripts/run_static_analysis.sh <forge-project-root-directory>`
23	- use `.ps1` script for windows
24	2. Read `manifest.yml` first before any deep code review.
25	3. Load `assets/security-rules/_global-forge.mdc` first.
26	4. Load only relevant category index rules based on manifest and code signals.
27	5. Load deep subrules only when the matching detection heuristics are triggered by real code patterns.
28	6. Perform an evidence-based security review across:
29	- AuthN/AuthZ
30	- Injection and input validation
31	- Tenant isolation and cross-tenant leakage
32	- Secrets and storage
33	- Egress/remotes/CSP and manifest permissions
34	- Public entry points (web triggers)
35	- Agent and miscellaneous Forge security risks
36	7. Do not modify app code unless the user explicitly requests fixes.
37	8. Write all scan outputs and generated artifacts to `security-audit-artifacts/`.
38
39	## Rule Routing Workflow
40
41	### Phase 1: Reconnaissance (Mandatory)
42
43	Read `manifest.yml` first and extract:
44
45	- `permissions.scopes`
46	- `permissions.external.fetch`
47	- `permissions.content.scripts`
48	- `modules` (resolver/webtrigger/scheduledTrigger/rovo/etc.)
49	- `remotes`
50	- `app.runtime.name`
51
52	Build an execution map:
53
54	- UI modules -> bridge calls -> resolvers/functions
55	- External entry points (web triggers, events, schedules)
56	- `api.asUser()` vs `api.asApp()` paths
57	- Outbound fetch destinations
58
59	### Phase 2: Index Rule Selection (Two-Tier Loading)
60
61	Always load first:
62
63	- `assets/security-rules/_global-forge.mdc`
64
65	Then load only relevant category index rules:
66
67	\| Signal \| Load \|
68	\| --------------------------------------------------------- \| -------------------------------------------------------------------------------------- \|
69	\| Any meaningful scope usage, mutations, or `asApp()` usage \| `assets/security-rules/forge-authn-authz/_index-authn-authz.mdc` \|
70	\| `webtrigger` or `scheduledTrigger` modules \| `assets/security-rules/forge-webtrigger-entrypoints/_index-webtrigger-entrypoints.mdc` \|
71	\| `permissions.external.fetch` or `remotes` \| `assets/security-rules/forge-egress-remotes/_index-egress-remotes.mdc` \|
72	\| SQL APIs or untrusted input reaching resolver sinks \| `assets/security-rules/forge-injection/_index-injection.mdc` \|
73	\| Multi-tenant patterns, module/global state, cache reuse \| `assets/security-rules/forge-tenant-isolation/_index-tenant-isolation.mdc` \|
74	\| Credentials/tokens/secrets handling \| `assets/security-rules/forge-secrets-storage/_index-secrets-storage.mdc` \|
75	\| Unsafe CSP or likely scope/config misconfiguration \| `assets/security-rules/forge-manifest-config/_index-manifest-config.mdc` \|
76	\| Rovo modules/actions \| `assets/security-rules/forge-rovo-agents/_index-rovo-agents.mdc` \|
77	\| Baseline logging/error/static analysis concerns \| `assets/security-rules/forge-auditing/_index-auditing.mdc` \|
78	\| Dependency/package risk review \| `assets/security-rules/forge-misc/_index-misc.mdc` \|
79
80	Subrule policy:
81
82	- After reading an index, load only the subrules that match the detection heuristics observed in code.
83	- Do not pre-load every subrule in a category.
84
85	### Phase 3: Analysis and Verification
86
87	For each loaded category:
88
89	1. Enumerate reachable entry points.
90	2. Trace source -> validation/authz -> sink.
91	3. Confirm exploitability with evidence.
92	4. Score confirmed findings with CVSS v3.1.
93
94	## Focus

People who liked this also viewed

6 picks

Type

forge-security-review

102installs8forks

View on GitHub

How to install forge-security-review?

atlassian/forge-skills/forge-security-review

$npx -y skills add atlassian/forge-skills --skill forge-security-review

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Forge Security Review
2
3	Runs a Forge-focused white-box security review and reports validated findings with exploitability, impact, evidence, and remediation guidance.
4
5	## Token-Efficient Default
6
7	Use manifest-driven routing by default to reduce token usage. Do not load every rule file up front.
8
9	## Rule Assets
10
11	The review rules are packaged with this skill under `assets/security-rules/`:
12
13	- Global baseline: `assets/security-rules/_global-forge.mdc`
14	- Category indexes: `assets/security-rules/forge-/_index-.mdc`
15	- Category deep checks: `assets/security-rules/forge-/.mdc`
16
17	## Execution Mandate
18
19	When this skill is triggered:
20
21	1. Run static analysis first from this skill directory:
22	- `scripts/run_static_analysis.sh <forge-project-root-directory>`
23	- use `.ps1` script for windows
24	2. Read `manifest.yml` first before any deep code review.
25	3. Load `assets/security-rules/_global-forge.mdc` first.
26	4. Load only relevant category index rules based on manifest and code signals.
27	5. Load deep subrules only when the matching detection heuristics are triggered by real code patterns.
28	6. Perform an evidence-based security review across:
29	- AuthN/AuthZ
30	- Injection and input validation
31	- Tenant isolation and cross-tenant leakage
32	- Secrets and storage
33	- Egress/remotes/CSP and manifest permissions
34	- Public entry points (web triggers)
35	- Agent and miscellaneous Forge security risks
36	7. Do not modify app code unless the user explicitly requests fixes.
37	8. Write all scan outputs and generated artifacts to `security-audit-artifacts/`.
38
39	## Rule Routing Workflow
40
41	### Phase 1: Reconnaissance (Mandatory)
42
43	Read `manifest.yml` first and extract:
44
45	- `permissions.scopes`
46	- `permissions.external.fetch`
47	- `permissions.content.scripts`
48	- `modules` (resolver/webtrigger/scheduledTrigger/rovo/etc.)
49	- `remotes`
50	- `app.runtime.name`
51
52	Build an execution map:
53
54	- UI modules -> bridge calls -> resolvers/functions
55	- External entry points (web triggers, events, schedules)
56	- `api.asUser()` vs `api.asApp()` paths
57	- Outbound fetch destinations
58
59	### Phase 2: Index Rule Selection (Two-Tier Loading)
60
61	Always load first:
62
63	- `assets/security-rules/_global-forge.mdc`
64
65	Then load only relevant category index rules:
66
67	\| Signal \| Load \|
68	\| --------------------------------------------------------- \| -------------------------------------------------------------------------------------- \|
69	\| Any meaningful scope usage, mutations, or `asApp()` usage \| `assets/security-rules/forge-authn-authz/_index-authn-authz.mdc` \|
70	\| `webtrigger` or `scheduledTrigger` modules \| `assets/security-rules/forge-webtrigger-entrypoints/_index-webtrigger-entrypoints.mdc` \|
71	\| `permissions.external.fetch` or `remotes` \| `assets/security-rules/forge-egress-remotes/_index-egress-remotes.mdc` \|
72	\| SQL APIs or untrusted input reaching resolver sinks \| `assets/security-rules/forge-injection/_index-injection.mdc` \|
73	\| Multi-tenant patterns, module/global state, cache reuse \| `assets/security-rules/forge-tenant-isolation/_index-tenant-isolation.mdc` \|
74	\| Credentials/tokens/secrets handling \| `assets/security-rules/forge-secrets-storage/_index-secrets-storage.mdc` \|
75	\| Unsafe CSP or likely scope/config misconfiguration \| `assets/security-rules/forge-manifest-config/_index-manifest-config.mdc` \|
76	\| Rovo modules/actions \| `assets/security-rules/forge-rovo-agents/_index-rovo-agents.mdc` \|
77	\| Baseline logging/error/static analysis concerns \| `assets/security-rules/forge-auditing/_index-auditing.mdc` \|
78	\| Dependency/package risk review \| `assets/security-rules/forge-misc/_index-misc.mdc` \|
79
80	Subrule policy:
81
82	- After reading an index, load only the subrules that match the detection heuristics observed in code.
83	- Do not pre-load every subrule in a category.
84
85	### Phase 3: Analysis and Verification
86
87	For each loaded category:
88
89	1. Enumerate reachable entry points.
90	2. Trace source -> validation/authz -> sink.
91	3. Confirm exploitability with evidence.
92	4. Score confirmed findings with CVSS v3.1.
93
94	## Focus

People who liked this also viewed

6 picks

Type