v3-security-overhaul

Name: v3-security-overhaul
Author: spencermarx

301stars24forks

How to install v3-security-overhaul?

spencermarx/open-code-review/v3-security-overhaul

$npx -y skills add spencermarx/open-code-review --skill v3-security-overhaul

Installs into the current project.

Summary

Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for security-first v3 implementation.

Files · 1

View on GitHub

SKILL.md

1	# V3 Security Overhaul
2
3	## What This Skill Does
4
5	Orchestrates comprehensive security overhaul for claude-flow v3, addressing critical vulnerabilities and establishing security-first development practices using specialized v3 security agents.
6
7	## Quick Start
8
9	```bash
10	# Initialize V3 security domain (parallel)
11	Task("Security architecture", "Design v3 threat model and security boundaries", "v3-security-architect")
12	Task("CVE remediation", "Fix CVE-1, CVE-2, CVE-3 critical vulnerabilities", "security-auditor")
13	Task("Security testing", "Implement TDD London School security framework", "test-architect")
14	```
15
16	## Critical Security Fixes
17
18	### CVE-1: Vulnerable Dependencies
19	```bash
20	npm update @anthropic-ai/claude-code@^2.0.31
21	npm audit --audit-level high
22	```
23
24	### CVE-2: Weak Password Hashing
25	```typescript
26	// ❌ Old: SHA-256 with hardcoded salt
27	const hash = crypto.createHash('sha256').update(password + salt).digest('hex');
28
29	// ✅ New: bcrypt with 12 rounds
30	import bcrypt from 'bcrypt';
31	const hash = await bcrypt.hash(password, 12);
32	```
33
34	### CVE-3: Hardcoded Credentials
35	```typescript
36	// ✅ Generate secure random credentials
37	const apiKey = crypto.randomBytes(32).toString('hex');
38	```
39
40	## Security Patterns
41
42	### Input Validation (Zod)
43	```typescript
44	import { z } from 'zod';
45
46	const TaskSchema = z.object({
47	taskId: z.string().uuid(),
48	content: z.string().max(10000),
49	agentType: z.enum(['security', 'core', 'integration'])
50	});
51	```
52
53	### Path Sanitization
54	```typescript
55	function securePath(userPath: string, allowedPrefix: string): string {
56	const resolved = path.resolve(allowedPrefix, userPath);
57	if (!resolved.startsWith(path.resolve(allowedPrefix))) {
58	throw new SecurityError('Path traversal detected');
59	}
60	return resolved;
61	}
62	```
63
64	### Safe Command Execution
65	```typescript
66	import { execFile } from 'child_process';
67
68	// ✅ Safe: No shell interpretation
69	const { stdout } = await execFile('git', [userInput], { shell: false });
70	```
71
72	## Success Metrics
73
74	- Security Score: 90/100 (npm audit + custom scans)
75	- CVE Resolution: 100% of critical vulnerabilities fixed
76	- Test Coverage: >95% security-critical code
77	- Implementation: All secure patterns documented and tested

People who liked this also viewed

6 picks

Type

v3-security-overhaul

301stars24forks

View on GitHub

How to install v3-security-overhaul?

spencermarx/open-code-review/v3-security-overhaul

$npx -y skills add spencermarx/open-code-review --skill v3-security-overhaul

Installs into the current project.

Summary

Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for security-first v3 implementation.

Files · 1

View on GitHub

SKILL.md

1	# V3 Security Overhaul
2
3	## What This Skill Does
4
5	Orchestrates comprehensive security overhaul for claude-flow v3, addressing critical vulnerabilities and establishing security-first development practices using specialized v3 security agents.
6
7	## Quick Start
8
9	```bash
10	# Initialize V3 security domain (parallel)
11	Task("Security architecture", "Design v3 threat model and security boundaries", "v3-security-architect")
12	Task("CVE remediation", "Fix CVE-1, CVE-2, CVE-3 critical vulnerabilities", "security-auditor")
13	Task("Security testing", "Implement TDD London School security framework", "test-architect")
14	```
15
16	## Critical Security Fixes
17
18	### CVE-1: Vulnerable Dependencies
19	```bash
20	npm update @anthropic-ai/claude-code@^2.0.31
21	npm audit --audit-level high
22	```
23
24	### CVE-2: Weak Password Hashing
25	```typescript
26	// ❌ Old: SHA-256 with hardcoded salt
27	const hash = crypto.createHash('sha256').update(password + salt).digest('hex');
28
29	// ✅ New: bcrypt with 12 rounds
30	import bcrypt from 'bcrypt';
31	const hash = await bcrypt.hash(password, 12);
32	```
33
34	### CVE-3: Hardcoded Credentials
35	```typescript
36	// ✅ Generate secure random credentials
37	const apiKey = crypto.randomBytes(32).toString('hex');
38	```
39
40	## Security Patterns
41
42	### Input Validation (Zod)
43	```typescript
44	import { z } from 'zod';
45
46	const TaskSchema = z.object({
47	taskId: z.string().uuid(),
48	content: z.string().max(10000),
49	agentType: z.enum(['security', 'core', 'integration'])
50	});
51	```
52
53	### Path Sanitization
54	```typescript
55	function securePath(userPath: string, allowedPrefix: string): string {
56	const resolved = path.resolve(allowedPrefix, userPath);
57	if (!resolved.startsWith(path.resolve(allowedPrefix))) {
58	throw new SecurityError('Path traversal detected');
59	}
60	return resolved;
61	}
62	```
63
64	### Safe Command Execution
65	```typescript
66	import { execFile } from 'child_process';
67
68	// ✅ Safe: No shell interpretation
69	const { stdout } = await execFile('git', [userInput], { shell: false });
70	```
71
72	## Success Metrics
73
74	- Security Score: 90/100 (npm audit + custom scans)
75	- CVE Resolution: 100% of critical vulnerabilities fixed
76	- Test Coverage: >95% security-critical code
77	- Implementation: All secure patterns documented and tested

People who liked this also viewed

6 picks

Type