mirror of
https://github.com/secondsky/claude-skills.git
synced 2026-09-18 19:54:22 +08:00
secondsky
efee8ac6e9
Unified OSS-only cybersecurity skill with progressive disclosure. Fills the repo's offensive-security gap — the 5 existing security plugins are all defensive; this adds find / analyze / threat-model coverage. Plugin layout under plugins/cybersecurity/: - SKILL.md: thin router + dispatcher (241 lines, sub-agent model per decision #5) - 15 references/*.md docs, each a dispatchable sub-agent briefing - .claude-plugin/plugin.json: registered in security category Fuses 7 community skills ported to fully open-source tooling: - mukul975: business-logic, XSS (DOM Invader gap acknowledged), host-header, open-redirect, forced-browsing - rysweet/amplihack: cybersecurity-analyst 11-step reasoning framework - Aradotso: security-detections-mcp (Sigma + MITRE ATT&CK, local OSS path recommended; hosted API documented as optional) Integrates 20 Aradotso dev-security skills across 5 grouped docs: - aradotso-code-audit (A1,A3,A4,A5,A6,A7,A8,A10) - aradotso-agent-safety (F2,G3) - aradotso-compliance (C1) - aradotso-web-vuln-testing (D1-D4) - aradotso-ai-security (E1-E4) Authorization gate (ORCHESTRATION decision #3): - Track A (always-on): static analysis, SAST, threat modeling, code review, detection authoring - Track B (gated): live-target testing requires ack of authorization disclaimer, which runs in main context before any sub-agent dispatch - Red-flags list refuses DoS, cred-stuffing, gov/critical-infra, SE Cross-references (not duplicates) the 5 existing defensive plugins: - csrf-protection, xss-prevention, vulnerability-scanning, security-headers-configuration, defense-in-depth-validation Includes centralized oss-tool-map.md (Burp/Collaborator/Nessus/SonarQube/ Splunk/CrowdStrike/DOM Invader/Hackvertor/XSS Hunter -> OSS alternatives). Other changes: - scripts/lib/categorize.sh: add cybersecurity to security category whitelist - scripts/generate-marketplace.sh: bump hardcoded version to 3.5.0 - Bump marketplace.json + all 142 plugin.json versions to 3.5.0 - Update README.md, MARKETPLACE.md, CHANGELOG.md, package.json