Security scan
AI coding agent runtime that makes LLMs understand your codebase with repository-aware context, memory, and continuous learning
npx -y skills add ldilov/harness-forge --skill security-scanAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Defensive review checklist for secrets, auth boundaries, input validation, and package safety.
SKILL.md
1.2 KB, as published. Nobody here has run it
Security Scan
Trigger Signals
- the task touches auth, secrets, privileged routes, or network boundaries
- the repository is a service or security-sensitive runtime
Inspect First
- environment and config surfaces
- auth middleware, handlers, route guards, and secret-loading code
- dependency manifests and externally reachable entrypoints
Workflow
- identify exposed trust boundaries and secret-bearing paths
- inspect input validation, auth, and authorization behavior
- review dependency, logging, and data-exposure risks
- summarize concrete findings and remediation priorities
Output Contract
- attack-surface summary
- ordered findings with severity
- recommended remediations
- residual risk note
Failure Modes
- the task scope hides the actual runtime boundary
- there is no reliable way to trace user input to protected operations
Escalation
- escalate when a likely secret leak or auth bypass is detected
- escalate when the scan cannot safely verify a high-risk boundary
References
skills/security-scan/references/review-checklist.md