Janef

Skill AL-JANEF/janefskills/janef

Defensive security & production-grade engineering skills for Claude Code — auth, OWASP audit, threat modeling, secrets, logging.

Install

npx -y skills add AL-JANEF/janefskills --skill janef

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

11 days oldThe repository was created 11 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Entry point to the janefskills security & engineering suite. Invoke with /janef to route a security or code-quality task to the right specialist skill — auth-hardening, vuln-audit, threat-model, secrets-guard, security-logging, or engineering-standard — or to run a full multi-skill security pass. Use when you want the janefskills suite but don't want to remember which specific skill applies. Defensive only.

SKILL.md

4.1 KB, as published. Nobody here has run it

janef — janefskills entry point

This is the front door to the janefskills suite. Its job is to take whatever the user asks after /janef and route it to the right specialist skill, or run a coordinated pass across several. It does not re-implement the specialists — it directs to them.

How to use it

The user types /janef followed by what they want, e.g.:

/janef review the login flow → route to auth-hardening
/janef audit this file for vulnerabilities → route to vuln-audit
/janef threat model this new API → route to threat-model
/janef is this safe to commit? → route to secrets-guard
/janef add an audit trail → route to security-logging
/janef make this production-ready → route to engineering-standard
/janef full security pass → run the coordinated multi-skill review below

If the user types just /janef with nothing after it, briefly list the suite (the six skills and one line each) and ask which they want — don't guess.

Routing

Match the request to the specialist by intent:

If the request is about…	Route to
login, logout, sessions, passwords, tokens, MFA, brute-force	`auth-hardening`
finding bugs/vulnerabilities, OWASP, injection, XSS, CSRF, SSRF, IDOR, uploads	`vuln-audit`
designing a system/feature/API, "what could go wrong", risks before building	`threat-model`
API keys, credentials, `.env`, secrets in code/history/client bundle	`secrets-guard`
audit logging, monitoring, detecting suspicious activity	`security-logging`
overall code quality, "production-ready", strict review, refactor, correctness	`engineering-standard`

When one skill clearly fits, apply that skill's method and its output format. State which skill you're applying in one short line, then do the work — don't make the user pick again if the intent is clear.

If the request spans two areas (e.g. "review this auth code for vulnerabilities"), apply both the relevant specialists in sequence and merge the findings into one severity-ranked report.

Full security pass

When the user asks for a full/complete security pass (/janef full security pass or similar) on a codebase or feature, run the specialists in this order and produce one consolidated report:

threat-model — if there's a design or feature to model, surface the risks first so the rest of the pass knows what to look for.
secrets-guard — scan for exposed credentials; a leaked secret outranks most other findings.
auth-hardening — review authentication and session handling.
vuln-audit — audit the code for OWASP-class vulnerabilities.
security-logging — check that sensitive actions are logged without leaking.
engineering-standard — hold the whole result to the production-grade bar and run the completion gate.

Consolidate into a single report:

## janef security pass: <target>

### Critical    (exploitable now / secrets exposed — fix before shipping)
- [skill] <finding> → <fix>

### High
- [skill] ...

### Medium / Hardening
- ...

### Verified good
- ...

### Coverage
- Skills applied: <which of the six ran, and which were N/A and why>

Tag each finding with the specialist it came from ([auth-hardening], [vuln-audit], …) so the user can go deeper with that skill.

Principles carried from the suite

Whatever gets routed, the suite's rules hold: defensive only (no exploits, no bypasses), the server is the only place trust lives, and proof before done — every finding names a concrete fix, and any claim of "fixed" or "passes" carries its evidence rather than being asserted.