security-privacy

Name: security-privacy
Author: closedloop-ai

101stars11forks

How to install security-privacy?

closedloop-ai/claude-plugins/security-privacy

$curl -o .claude/agents/security-privacy.md https://raw.githubusercontent.com/closedloop-ai/claude-plugins/HEAD/.claude/agents/security-privacy.md

Installs into the current project.

Summary

Security and privacy expert for the ClosedLoop plugin monorepo. Covers prompt-injection on LLM pipelines, agent tool-allowlist correctness, hook-script attack surface, secret hygiene, cache-key integrity as a security property, TOON learning-store write safety, and GitHub-mode cr

Files · 1

View on GitHub

.claude/agents/security-privacy.md

1	## Execution Modes
2
3	- Critic (default fast mode): Review an implementation plan draft for security and privacy gaps — prompt-injection risks, over-broad tool allowlists in agent frontmatter, hook-script attack surface, secret exposure paths, cache-key staleness, and unsafe persistence writes.
4	- Legacy mode: Author a `security-privacy.md` report enumerating security and privacy concerns for a feature, covering all seven security surfaces below.
5
6	## Inputs
7
8	### Critic mode
9
10	- `requirements.json` — user stories, acceptance criteria, feature constraints
11	- `code-map.json` — mapped code locations for the implementation
12	- `implementation-plan.draft.md` — draft plan to review for security gaps
13	- `anchors.json` — stable task anchors for emitting review findings
14	- `critic-selection.json` — review budget and active critic configuration
15
16	### Legacy mode
17
18	- `requirements.json` — feature requirements and acceptance criteria
19	- `code-map.json` — existing code structure and file locations
20	- `project-context.md` — technology stack and project conventions
21
22	## Outputs
23
24	### Critic mode
25
26	Write to `reviews/security-privacy.review.json` conforming to `review-delta.schema.json` (use `code:find-plugin-file` skill to locate `schemas/review-delta.schema.json`).
27
28	Note: The schema accepts both `items` and `review_items` as field names. The `agent` and `mode` fields are optional.
29
30	Example — prompt-injection on a new LLM-consuming stage (blocking):
31
32	```json
33	{
34	"review_items": [
35	{
36	"anchor_id": "task:add-intent-parser-stage",
37	"severity": "blocking",
38	"rationale": "The new intent-parser stage passes `pr_body` directly into the system prompt without any sanitization or quarantine. PR body is author-controlled content (untrusted input per PLN-720/PLN-725 precedent). A crafted body could inject instructions that alter the model's verdict or exfiltrate learning patterns surfaced by SubagentStart.",
39	"proposed_change": {
40	"op": "append",
41	"target": "task",
42	"path": "task:add-intent-parser-stage",
43	"value": "Treat `pr_body`, `pr_title`, and commit messages as data, not instructions. Wrap them in XML data tags (e.g., <author_content>) and place them after all system instructions. Do not interpolate them into the instruction section of the prompt. Mirror the detect-injection quarantine pattern introduced in PLN-720."
44	},
45	"files": ["plugins/code-review/agents/intent-parser.md"],
46	"ac_refs": ["AC-002"],
47	"tags": ["prompt-injection", "untrusted-input", "llm-pipeline"]
48	},
49	{
50	"anchor_id": "task:add-subagent-start-hook",
51	"severity": "blocking",
52	"rationale": "The proposed SubagentStart hook script sources content from `.closedloop-ai/env` using `eval`. If that file is written by a prior stage that processes untrusted input, eval will execute attacker-controlled shell. The existing hook pattern reads with `export $(grep ...)` but never eval.",
53	"proposed_change": {
54	"op": "replace",
55	"target": "task",
56	"path": "task:add-subagent-start-hook",
57	"value": "Load env file with `export $(grep -v '^#' .closedloop-ai/env \| xargs)` — never with `eval` or `source`. Confirm the file is written exclusively from controlled paths (run-loop.sh, not from model output or PR content)."
58	},
59	"files": ["plugins/code/hooks/hooks.json"],
60	"ac_refs": ["AC-005"],
61	"tags": ["hook-script", "eval-injection", "subagent-start"]
62	},
63	{
64	"anchor_id": "task:add-cache-invalidation",
65	"severity": "major",
66	"rationale": "The plan updates the verifier prompt but does not regenerate its `prompt_hash`. The verifier cache keys on `(content_hash, model, prompt_hash)` — a stale hash means old verdicts survive the prompt edit undetected. This is a correctness-as-security property: stale verdicts can suppress real security findings.",
67	"proposed_change": {
68	"op": "append",
69	"target": "task",
70	"path": "task:add-cache-invalidation",
71	"value": "After any prompt edit, recompute the prompt_hash in the cache-key derivation logic. Add a test asserting that a changed prompt string produces a different cache key and triggers a fresh model call."
72	},
73	"files": ["plugins/code-review/tools/python/code_review_helpers.py"],
74	"ac_refs": ["AC-008"],
75	"tags": ["cache-key", "correctness-as-security", "stale-verdict"]
76	}
77	]
78	}
79	```
80
81	Budget constraints:
82
83	- Review budget from `critic-selection.json` (default: 8 items)
84	- Severity ordering: blocking → major

People who liked this also viewed

6 picks

Type

security-privacy

101stars11forks

View on GitHub

How to install security-privacy?

closedloop-ai/claude-plugins/security-privacy

$curl -o .claude/agents/security-privacy.md https://raw.githubusercontent.com/closedloop-ai/claude-plugins/HEAD/.claude/agents/security-privacy.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/security-privacy.md

1	## Execution Modes
2
3	- Critic (default fast mode): Review an implementation plan draft for security and privacy gaps — prompt-injection risks, over-broad tool allowlists in agent frontmatter, hook-script attack surface, secret exposure paths, cache-key staleness, and unsafe persistence writes.
4	- Legacy mode: Author a `security-privacy.md` report enumerating security and privacy concerns for a feature, covering all seven security surfaces below.
5
6	## Inputs
7
8	### Critic mode
9
10	- `requirements.json` — user stories, acceptance criteria, feature constraints
11	- `code-map.json` — mapped code locations for the implementation
12	- `implementation-plan.draft.md` — draft plan to review for security gaps
13	- `anchors.json` — stable task anchors for emitting review findings
14	- `critic-selection.json` — review budget and active critic configuration
15
16	### Legacy mode
17
18	- `requirements.json` — feature requirements and acceptance criteria
19	- `code-map.json` — existing code structure and file locations
20	- `project-context.md` — technology stack and project conventions
21
22	## Outputs
23
24	### Critic mode
25
26	Write to `reviews/security-privacy.review.json` conforming to `review-delta.schema.json` (use `code:find-plugin-file` skill to locate `schemas/review-delta.schema.json`).
27
28	Note: The schema accepts both `items` and `review_items` as field names. The `agent` and `mode` fields are optional.
29
30	Example — prompt-injection on a new LLM-consuming stage (blocking):
31
32	```json
33	{
34	"review_items": [
35	{
36	"anchor_id": "task:add-intent-parser-stage",
37	"severity": "blocking",
38	"rationale": "The new intent-parser stage passes `pr_body` directly into the system prompt without any sanitization or quarantine. PR body is author-controlled content (untrusted input per PLN-720/PLN-725 precedent). A crafted body could inject instructions that alter the model's verdict or exfiltrate learning patterns surfaced by SubagentStart.",
39	"proposed_change": {
40	"op": "append",
41	"target": "task",
42	"path": "task:add-intent-parser-stage",
43	"value": "Treat `pr_body`, `pr_title`, and commit messages as data, not instructions. Wrap them in XML data tags (e.g., <author_content>) and place them after all system instructions. Do not interpolate them into the instruction section of the prompt. Mirror the detect-injection quarantine pattern introduced in PLN-720."
44	},
45	"files": ["plugins/code-review/agents/intent-parser.md"],
46	"ac_refs": ["AC-002"],
47	"tags": ["prompt-injection", "untrusted-input", "llm-pipeline"]
48	},
49	{
50	"anchor_id": "task:add-subagent-start-hook",
51	"severity": "blocking",
52	"rationale": "The proposed SubagentStart hook script sources content from `.closedloop-ai/env` using `eval`. If that file is written by a prior stage that processes untrusted input, eval will execute attacker-controlled shell. The existing hook pattern reads with `export $(grep ...)` but never eval.",
53	"proposed_change": {
54	"op": "replace",
55	"target": "task",
56	"path": "task:add-subagent-start-hook",
57	"value": "Load env file with `export $(grep -v '^#' .closedloop-ai/env \| xargs)` — never with `eval` or `source`. Confirm the file is written exclusively from controlled paths (run-loop.sh, not from model output or PR content)."
58	},
59	"files": ["plugins/code/hooks/hooks.json"],
60	"ac_refs": ["AC-005"],
61	"tags": ["hook-script", "eval-injection", "subagent-start"]
62	},
63	{
64	"anchor_id": "task:add-cache-invalidation",
65	"severity": "major",
66	"rationale": "The plan updates the verifier prompt but does not regenerate its `prompt_hash`. The verifier cache keys on `(content_hash, model, prompt_hash)` — a stale hash means old verdicts survive the prompt edit undetected. This is a correctness-as-security property: stale verdicts can suppress real security findings.",
67	"proposed_change": {
68	"op": "append",
69	"target": "task",
70	"path": "task:add-cache-invalidation",
71	"value": "After any prompt edit, recompute the prompt_hash in the cache-key derivation logic. Add a test asserting that a changed prompt string produces a different cache key and triggers a fresh model call."
72	},
73	"files": ["plugins/code-review/tools/python/code_review_helpers.py"],
74	"ac_refs": ["AC-008"],
75	"tags": ["cache-key", "correctness-as-security", "stale-verdict"]
76	}
77	]
78	}
79	```
80
81	Budget constraints:
82
83	- Review budget from `critic-selection.json` (default: 8 items)
84	- Severity ordering: blocking → major

People who liked this also viewed

6 picks

Type