History

Grovy311 afd8019a7b Some checks are pending security-baseline / secrets (push) Waiting to run Details security-baseline / node (push) Waiting to run Details security-baseline / semgrep (push) Waiting to run Details security-baseline / trivy (push) Waiting to run Details Address security review notes - log only the error name for rejected 4xx requests (JSON.parse messages can quote the request body, e.g. a password) - refuse LB_DATABASE_PATH in production; it is test-only - fix two stale file references in the skill texts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>		2026-10-15 09:45:59 +02:00
..
authz-idor-audit	Address security review notes	2026-10-15 09:45:59 +02:00
codeguard	Address security review notes	2026-10-15 09:45:59 +02:00
dependency-vetting	Add agent security skills for Codex and Claude Code	2026-10-15 09:40:33 +02:00
pre-release-gate	Add agent security skills for Codex and Claude Code	2026-10-15 09:40:33 +02:00
security-review	Add agent security skills for Codex and Claude Code	2026-10-15 09:40:33 +02:00
threat-model-light	Add agent security skills for Codex and Claude Code	2026-10-15 09:40:33 +02:00
README.md	Add agent security skills for Codex and Claude Code	2026-10-15 09:40:33 +02:00

README.md

Agent skills (test & security baseline)

The same skills live in .agents/skills/ (Codex) and .claude/skills/ (Claude Code). Keep both folders identical when changing a skill: diff -r .agents/skills .claude/skills. Source: Christian's skill repo cj/claude-skills; the skill texts are in German.

Skill	Use it for
`codeguard`	Secure-coding rules (Project CodeGuard) while writing or changing code
`security-review`	Reviewing a diff against the ASVS-light checklist, in a fresh context
`dependency-vetting`	Checking a new npm package before adding it (also `make vet-deps`)
`pre-release-gate`	Go / Go with conditions / No-Go before a deploy
`authz-idor-audit`	Systematic check of role and object permissions
`threat-model-light`	One-page threat model for the app or a feature