agentsclimarketplace

Security scan

Skill ldilov/harness-forge/skills/security-scan

AI coding agent runtime that makes LLMs understand your codebase with repository-aware context, memory, and continuous learning

Install
npx -y skills add ldilov/harness-forge --skill security-scan

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Defensive review checklist for secrets, auth boundaries, input validation, and package safety.

SKILL.md

1.2 KB, as published. Nobody here has run it

Security Scan

Trigger Signals

  • the task touches auth, secrets, privileged routes, or network boundaries
  • the repository is a service or security-sensitive runtime

Inspect First

  • environment and config surfaces
  • auth middleware, handlers, route guards, and secret-loading code
  • dependency manifests and externally reachable entrypoints

Workflow

  1. identify exposed trust boundaries and secret-bearing paths
  2. inspect input validation, auth, and authorization behavior
  3. review dependency, logging, and data-exposure risks
  4. summarize concrete findings and remediation priorities

Output Contract

  • attack-surface summary
  • ordered findings with severity
  • recommended remediations
  • residual risk note

Failure Modes

  • the task scope hides the actual runtime boundary
  • there is no reliable way to trace user input to protected operations

Escalation

  • escalate when a likely secret leak or auth bypass is detected
  • escalate when the scan cannot safely verify a high-risk boundary

References

  • skills/security-scan/references/review-checklist.md

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.