Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Security Pipeline · sangrokjung | DecimalAI

securityby sangrokjung

Security Pipeline

sangrokjung/security-pipeline

Source sangrokjung/claude-forge ↗License MIT

Use when security verification is needed - pre-commit security checks, vulnerability scanning, STRIDE threat analysis. Integrates with /handoff-verify --security and /commit-push-pr. CWE Top 25 based.

SkillScore86Maintained

Automatic

Security & AppSec pack

Last verified 8/14/2026

What it changes

Passed 19 of 22 test cases with the skill, and 9 of 22 without it.

Without skill41%

With skill86%

Checks it passed that the model alone missed

Classifies unsafe deserialization as High severity level.
Proposes removing the sensitive logging line as the auto-fix.
Identifies the innerHTML usage as CWE-79 with Critical severity.

and 12 more in the full report

10 fixed9 passed either way3 still failing0 broke

Pass-rate lift: +45 pp
Tokens: +42%
Agent turns: 0%
Response time: -19%

Model gemini-3.6-flashMeasured 8/14/2026v119 of 22 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/sangrokjung-security-pipeline/SKILL.md https://app.decimal.ai/s/sangrokjung-security-pipeline/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add sangrokjung-security-pipeline, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/sangrokjung-security-pipeline/ and pins it in .decimal/skills.lock

decimalai skills add sangrokjung-security-pipeline

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/sangrokjung-security-pipeline/SKILL.md https://app.decimal.ai/s/sangrokjung-security-pipeline/SKILL.md

Raw file: /s/sangrokjung-security-pipeline/SKILL.md ↗ · machine-readable summary at /s/sangrokjung-security-pipeline.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 10

Prompt

동적 코드 실행이나 직렬화 해제를 위해 `eval(userPayload)` 또는 `new Function(userPayload)` 구조를 사용하는 코드가 있습니다. 이 취약점에 적용할 CWE ID와 위험도 등급을 명시하세요.

What was checked, without and with the skill
Checked	Without skill	With skill
Assigns CWE-502 to unsafe deserialization and dynamic function evaluation.	Passed	Passed
Classifies unsafe deserialization as High severity level.	Missed	Passed

case-11 · gemini-3.6-flash · 8/14/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md147 linessingle file

Overview

보안 파이프라인 스킬은 코드 변경 시 자동으로 CWE Top 25 기반 보안 검증을 수행한다. /handoff-verify --security, /commit-push-pr 실행 시 통합 동작한다. 보안 체크리스트 참조: ~/.claude/skills/_reference/security-checklist.md

effort:max가 항상 강제 적용된다. 보안 검증은 축약하지 않는다.

Trigger Conditions

파일 패턴 기반 자동 트리거

다음 패턴을 포함하는 파일이 변경되면 보안 파이프라인이 자동으로 실행된다:

패턴	트리거 수준	설명
`/auth/`	Full Scan	인증 관련 모듈
`/payment/`	Full Scan	결제 처리 모듈
`/api/`	CWE Scan	API 엔드포인트
`/middleware/`	CWE Scan	미들웨어
`*/session`	CWE Scan	세션 관리
`*/token`	CWE Scan	토큰 처리
`*/crypto`	CWE Scan	암호화 로직
`/admin/`	Full + STRIDE	관리자 기능
`*/upload`	CWE Scan	파일 업로드
`*/.env`	Credential Scan	환경변수 파일
`*/config/secret`	Credential Scan	시크릿 설정

커밋 기반 자동 트리거

/commit-push-pr 실행 시 staged 파일 목록에서 위 패턴이 감지되면, 커밋 전 보안 파이프라인이 자동으로 실행된다.

CWE Scanning Rules

Critical (커밋 차단)

Track record

Benchmark

19 / 22

test cases passed, vs 9 / 22 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

sangrokjung / claude-forge

skills/security-pipeline/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

More skills from the same source and nearby in the registry, with their headline benchmark lift.