Release v2.2.0 — Security suite, self-eval, 223 skills by alirezarezvani · Pull Request #451 · alirezarezvani/claude-skills

alirezarezvani · 2026-03-31T05:56:13Z

Summary

8 new skills added: 6 security skills (adversarial-reviewer, ai-security, cloud-security, incident-response, red-team, threat-detection), self-eval, and snowflake-development
Full docs update across all files — CLAUDE.md, README.md, docs/index.md, docs/getting-started.md, mkdocs.yml, marketplace.json, domain plugin.json files
CHANGELOG.md updated with comprehensive v2.2.0 entry

What's New in v2.2.0

Metric	Before	After
Total Skills	205	223
Python Tools	268	298
Reference Guides	384	416
Agents	16	23
Commands	19	22
Engineering Core	30	36
Engineering POWERFUL	35	36
MkDocs Pages	210+	269 (301 HTML)

New Security Skills (engineering-team/)

adversarial-reviewer — 3 hostile reviewer personas
ai-security — ATLAS-mapped AI threat scanning
cloud-security — IAM/S3/SG posture checks (AWS/Azure/GCP)
incident-response — SEV1-4 triage + NIST SP 800-61
red-team — MITRE ATT&CK kill-chain planning
threat-detection — Hypothesis-driven threat hunting

New Engineering Skills

self-eval (engineering/) — Two-axis AI work quality scoring
snowflake-development (engineering-team/) — Snowflake SQL + pipelines

Verification

All 5 new Python scripts pass --help
Codex CLI sync: 182 skills indexed
Gemini CLI sync: 270 items indexed
MkDocs build passes (301 HTML pages)
All new SKILL.md files have valid YAML frontmatter
Count consistency verified across CLAUDE.md, README.md, docs/index.md, marketplace.json
All plugin.json versions bumped to 2.2.0

Test plan

Verify docs site renders correctly at GitHub Pages
Spot-check 2-3 new skill pages in MkDocs output
Confirm plugin install commands work for engineering-skills bundle
Verify backward compatibility — existing installations unaffected

https://claude.ai/code/session_011CHSDjqWBPRcEJ3oJrAUHS

- Enriched SKILL.md frontmatter (tier, category, dependencies, author, version) - Added Description, Features, Usage, Examples sections for validator compliance - Fixed cross-reference path (engineering/code-reviewer → engineering-team/code-reviewer) - Updated domain plugin.json count (30→31) - Added mkdocs.yml nav entry - Synced Codex, Gemini indexes - Generated docs page https://claude.ai/code/session_01XY4i7SR4BHLWJpdjwGnNLG

#436 (self-eval) - Updated domain plugin.json counts (engineering-team: 36, engineering: 36) - Added 6 new skills to mkdocs.yml navigation - Updated engineering-team/CLAUDE.md with security skills section - Generated docs pages for all 6 new skills - Synced Codex + Gemini indexes and symlinks - Ran cross-platform conversion (Cursor, Aider, Windsurf, KiloCode, OpenCode, Augment, Antigravity) https://claude.ai/code/session_01XY4i7SR4BHLWJpdjwGnNLG

- Add 8 new skills: 6 security (adversarial-reviewer, ai-security, cloud-security, incident-response, red-team, threat-detection), self-eval, snowflake-development - Update all counts: 223 skills, 298 tools, 416 references, 23 agents, 22 commands - Update CHANGELOG.md with v2.2.0 entry - Update all plugin.json versions to 2.2.0 - Update CLAUDE.md, README.md, docs/index.md, docs/getting-started.md, mkdocs.yml - Verify MkDocs build (301 pages), Codex/Gemini sync, all new scripts pass --help https://claude.ai/code/session_011CHSDjqWBPRcEJ3oJrAUHS

github-actions · 2026-03-31T05:56:42Z

🔒 Skill Security Audit Results

❌ `engineering-team` — FAIL

Severity	Count
🔴 Critical	13
🟡 High	19

Findings detail

{
  "severity": "HIGH",
  "category": "FS-HIDDEN",
  "file": "playwright-pro/.mcp.json",
  "line": 0,
  "pattern": ".mcp.json",
  "risk": "Hidden file '.mcp.json' \u2014 may contain secrets or hidden config",
  "fix": "Remove hidden files from skill distribution"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/security-pen-testing/scripts/vulnerability_scanner.py",
  "line": 163,
  "pattern": "\"recommendation\": \"Never use eval() or exec() with untrusted input. Use ast.literal_eval() for data parsing.\",",
  "risk": "Arbitrary code execution via eval()",
  "fix": "Use ast.literal_eval() for data parsing or explicit parsing logic"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/security-pen-testing/scripts/vulnerability_scanner.py",
  "line": 163,
  "pattern": "\"recommendation\": \"Never use eval() or exec() with untrusted input. Use ast.literal_eval() for data parsing.\",",
  "risk": "Arbitrary code execution via exec()",
  "fix": "Remove exec() \u2014 rewrite logic to avoid dynamic code execution"
}
{
  "severity": "HIGH",
  "category": "DESERIAL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/security-pen-testing/scripts/vulnerability_scanner.py",
  "line": 217,
  "pattern": "\"recommendation\": \"Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.\",",
  "risk": "Unsafe YAML loading \u2014 can execute arbitrary code",
  "fix": "Use yaml.safe_load() or yaml.load(data, Loader=yaml.SafeLoader)"
}
{
  "severity": "HIGH",
  "category": "DESERIAL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/security-pen-testing/scripts/vulnerability_scanner.py",
  "line": 406,
  "pattern": "\"Review code for pickle.load(), yaml.load(), Java ObjectInputStream.\",",
  "risk": "Pickle deserialization \u2014 can execute arbitrary code",
  "fix": "Use json.loads() or other safe serialization formats"
}
{
  "severity": "HIGH",
  "category": "DESERIAL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/security-pen-testing/scripts/vulnerability_scanner.py",
  "line": 406,
  "pattern": "\"Review code for pickle.load(), yaml.load(), Java ObjectInputStream.\",",
  "risk": "Unsafe YAML loading \u2014 can execute arbitrary code",
  "fix": "Use yaml.safe_load() or yaml.load(data, Loader=yaml.SafeLoader)"
}
{
  "severity": "HIGH",
  "category": "DESERIAL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/security-pen-testing/scripts/dependency_auditor.py",
  "line": 132,
  "pattern": "\"description\": \"PyYAML before 6.0.1 allows arbitrary code execution via yaml.load().\",",
  "risk": "Unsafe YAML loading \u2014 can execute arbitrary code",
  "fix": "Use yaml.safe_load() or yaml.load(data, Loader=yaml.SafeLoader)"
}
{
  "severity": "HIGH",
  "category": "FS-ABUSE",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-computer-vision/scripts/dataset_pipeline_builder.py",
  "line": 812,
  "pattern": "shutil.rmtree(temp_coco, ignore_errors=True)",
  "risk": "Recursive directory deletion \u2014 destructive operation",
  "fix": "Remove or restrict to specific, validated paths within skill scope"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-security/scripts/secret_scanner.py",
  "line": 384,
  "pattern": "\"scan_date\": __import__('datetime').datetime.now().isoformat(),",
  "risk": "Dynamic module import \u2014 can load arbitrary code",
  "fix": "Use explicit import statements"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-security/scripts/threat_modeler.py",
  "line": 468,
  "pattern": "\"analysis_date\": __import__('datetime').datetime.now().isoformat(),",
  "risk": "Dynamic module import \u2014 can load arbitrary code",
  "fix": "Use explicit import statements"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-secops/scripts/security_scanner.py",
  "line": 118,
  "pattern": "'exec() with potential user input'),",
  "risk": "Arbitrary code execution via exec()",
  "fix": "Remove exec() \u2014 rewrite logic to avoid dynamic code execution"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-secops/scripts/security_scanner.py",
  "line": 120,
  "pattern": "'eval() with potential user input'),",
  "risk": "Arbitrary code execution via eval()",
  "fix": "Use ast.literal_eval() for data parsing or explicit parsing logic"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-data-engineer/scripts/pipeline_orchestrator.py",
  "line": 339,
  "pattern": "compile(code, '<string>', 'exec')",
  "risk": "Dynamic code compilation for execution",
  "fix": "Remove compile() with exec mode \u2014 use explicit logic instead"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-data-engineer/scripts/pipeline_orchestrator.py",
  "line": 452,
  "pattern": "compile(code, '<string>', 'exec')",
  "risk": "Dynamic code compilation for execution",
  "fix": "Remove compile() with exec mode \u2014 use explicit logic instead"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-data-engineer/scripts/pipeline_orchestrator.py",
  "line": 579,
  "pattern": "compile(code, '<string>', 'exec')",
  "risk": "Dynamic code compilation for execution",
  "fix": "Remove compile() with exec mode \u2014 use explicit logic instead"
}
{
  "severity": "HIGH",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/playwright-pro/hooks/validate-test.sh",
  "line": 10,
  "pattern": "FILE_PATH=$(echo \"$INPUT\" | python3 -c \"",
  "risk": "Inline code execution in shell script",
  "fix": "Move code to a separate, inspectable script file"
}
{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py",
  "line": 321,
  "pattern": "result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)",
  "risk": "Shell injection via subprocess with shell=True",
  "fix": "Use subprocess.run() with list arguments and shell=False"
}
{
  "severity": "CRITICAL",
  "category": "CRED-HARVEST",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 524,
  "pattern": "SECRET_KEY = os.environ.get(\"DJANGO_SECRET_KEY\", \"change-me\")",
  "risk": "Reads sensitive environment variables",
  "fix": "Remove credential access. Skills should not need external credentials"
}
{
  "severity": "CRITICAL",
  "category": "CRED-HARVEST",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 558,
  "pattern": "\"PASSWORD\": os.environ.get(\"DB_PASSWORD\", \"password\"),",
  "risk": "Reads sensitive environment variables",
  "fix": "Remove credential access. Skills should not need external credentials"
}
{
  "severity": "CRITICAL",
  "category": "PROMPT-OVERRIDE",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/epic-design/SKILL.md",
  "line": 24,
  "pattern": "You are now a **world-class epic design expert**. You build cinematic, immersive websites that feel premium and alive \u2014 ",
  "risk": "Role hijacking \u2014 attempts to redefine the AI's identity",
  "fix": "Remove role redefinition. Skills should provide instructions, not identity changes"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-frontend/scripts/frontend_scaffolder.py",
  "line": 890,
  "pattern": "\"npm install\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/epic-design/scripts/inspect-assets.py",
  "line": 24,
  "pattern": "print(\"PIL not found. Install with: pip install Pillow\")",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-computer-vision/scripts/inference_optimizer.py",
  "line": 431,
  "pattern": "'onnxruntime': f'pip install onnxruntime-gpu',",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 661,
  "pattern": "RUN npm install",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 673,
  "pattern": "npm install",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 773,
  "pattern": "\"nextjs\": [f\"cd {name}\", \"npm install\", \"cp .env.example .env.local\", \"npm run dev\"],",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 777,
  "pattern": "\"cd backend && pip install -r requirements.txt && uvicorn app.main:app --reload\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 778,
  "pattern": "\"cd frontend && npm install && npm run dev\"",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 783,
  "pattern": "\"cd server && npm install && npm run dev\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 784,
  "pattern": "\"cd client && npm install && npm run dev\"",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 789,
  "pattern": "\"cd backend && pip install -r requirements.txt && python manage.py migrate && python manage.py runserver\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering-team/senior-fullstack/scripts/project_scaffolder.py",
  "line": 790,
  "pattern": "\"cd frontend && npm install && npm run dev\"",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}

✅ `engineering-team/adversarial-reviewer` — PASS

No findings.

❌ `engineering` — FAIL

Severity	Count
🔴 Critical	28
🟡 High	15

Findings detail

{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/autoresearch-agent/evaluators/benchmark_size.py",
  "line": 26,
  "pattern": "result = subprocess.run(BUILD_CMD, shell=True, capture_output=True)",
  "risk": "Shell injection via subprocess with shell=True",
  "fix": "Use subprocess.run() with list arguments and shell=False"
}
{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/autoresearch-agent/evaluators/benchmark_size.py",
  "line": 34,
  "pattern": "subprocess.run(DOCKER_BUILD_CMD, shell=True, capture_output=True)",
  "risk": "Shell injection via subprocess with shell=True",
  "fix": "Use subprocess.run() with list arguments and shell=False"
}
{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/autoresearch-agent/evaluators/test_pass_rate.py",
  "line": 13,
  "pattern": "result = subprocess.run(TEST_CMD, shell=True, capture_output=True, text=True, timeout=300)",
  "risk": "Shell injection via subprocess with shell=True",
  "fix": "Use subprocess.run() with list arguments and shell=False"
}
{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/autoresearch-agent/evaluators/build_speed.py",
  "line": 20,
  "pattern": "subprocess.run(CLEAN_CMD, shell=True, capture_output=True, timeout=60)",
  "risk": "Shell injection via subprocess with shell=True",
  "fix": "Use subprocess.run() with list arguments and shell=False"
}
{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/autoresearch-agent/evaluators/build_speed.py",
  "line": 23,
  "pattern": "result = subprocess.run(BUILD_CMD, shell=True, capture_output=True, timeout=600)",
  "risk": "Shell injection via subprocess with shell=True",
  "fix": "Use subprocess.run() with list arguments and shell=False"
}
{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/autoresearch-agent/evaluators/benchmark_speed.py",
  "line": 20,
  "pattern": "subprocess.run(COMMAND, shell=True, capture_output=True, timeout=120)",
  "risk": "Shell injection via subprocess with shell=True",
  "fix": "Use subprocess.run() with list arguments and shell=False"
}
{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/autoresearch-agent/evaluators/benchmark_speed.py",
  "line": 25,
  "pattern": "result = subprocess.run(COMMAND, shell=True, capture_output=True, timeout=120)",
  "risk": "Shell injection via subprocess with shell=True",
  "fix": "Use subprocess.run() with list arguments and shell=False"
}
{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 125,
  "pattern": "\"risk\": \"Arbitrary command execution via os.system()\",",
  "risk": "Arbitrary command execution via os.system()",
  "fix": "Use subprocess.run() with list arguments and shell=False"
}
{
  "severity": "CRITICAL",
  "category": "CMD-INJECT",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 132,
  "pattern": "\"risk\": \"Command execution via os.popen()\",",
  "risk": "Command execution via os.popen()",
  "fix": "Use subprocess.run() with list arguments and capture_output=True"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 154,
  "pattern": "\"risk\": \"Arbitrary code execution via eval()\",",
  "risk": "Arbitrary code execution via eval()",
  "fix": "Use ast.literal_eval() for data parsing or explicit parsing logic"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 161,
  "pattern": "\"risk\": \"Arbitrary code execution via exec()\",",
  "risk": "Arbitrary code execution via exec()",
  "fix": "Remove exec() \u2014 rewrite logic to avoid dynamic code execution"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 162,
  "pattern": "\"fix\": \"Remove exec() \u2014 rewrite logic to avoid dynamic code execution\",",
  "risk": "Arbitrary code execution via exec()",
  "fix": "Remove exec() \u2014 rewrite logic to avoid dynamic code execution"
}
{
  "severity": "CRITICAL",
  "category": "PRIV-ESC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 342,
  "pattern": "\"fix\": \"Remove sudo usage. Skills should never require elevated privileges\",",
  "risk": "Sudo invocation \u2014 privilege escalation attempt",
  "fix": "Remove sudo usage. Skills should never require elevated privileges"
}
{
  "severity": "HIGH",
  "category": "DESERIAL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 378,
  "pattern": "\"fix\": \"Use yaml.safe_load() or yaml.load(data, Loader=yaml.SafeLoader)\",",
  "risk": "Unsafe YAML loading \u2014 can execute arbitrary code",
  "fix": "Use yaml.safe_load() or yaml.load(data, Loader=yaml.SafeLoader)"
}
{
  "severity": "CRITICAL",
  "category": "PRIV-ESC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 468,
  "pattern": "\"regex\": r\"<!--\\s*(?:system|instruction|override|ignore|execute|run|sudo|admin)\",",
  "risk": "Sudo invocation \u2014 privilege escalation attempt",
  "fix": "Remove sudo usage. Skills should never require elevated privileges"
}
{
  "severity": "CRITICAL",
  "category": "CODE-EXEC",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 579,
  "pattern": "\"risk\": \"Dynamic Function constructor \u2014 equivalent to eval()\",",
  "risk": "Arbitrary code execution via eval()",
  "fix": "Use ast.literal_eval() for data parsing or explicit parsing logic"
}
{
  "severity": "HIGH",
  "category": "FS-ABUSE",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 918,
  "pattern": "shutil.rmtree(tmp_dir, ignore_errors=True)",
  "risk": "Recursive directory deletion \u2014 destructive operation",
  "fix": "Remove or restrict to specific, validated paths within skill scope"
}
{
  "severity": "HIGH",
  "category": "FS-ABUSE",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 930,
  "pattern": "shutil.rmtree(tmp_dir, ignore_errors=True)",
  "risk": "Recursive directory deletion \u2014 destructive operation",
  "fix": "Remove or restrict to specific, validated paths within skill scope"
}
{
  "severity": "HIGH",
  "category": "FS-ABUSE",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 1046,
  "pattern": "shutil.rmtree(cleanup_dir, ignore_errors=True)",
  "risk": "Recursive directory deletion \u2014 destructive operation",
  "fix": "Remove or restrict to specific, validated paths within skill scope"
}
{
  "severity": "CRITICAL",
  "category": "NET-EXFIL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/tech-debt-tracker/assets/sample_codebase/src/payment_processor.py",
  "line": 100,
  "pattern": "response = requests.post(",
  "risk": "Outbound HTTP write request \u2014 potential data exfiltration",
  "fix": "Remove outbound POST/PUT/PATCH or verify destination is trusted and necessary"
}
{
  "severity": "CRITICAL",
  "category": "NET-EXFIL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/tech-debt-tracker/assets/sample_codebase/src/payment_processor.py",
  "line": 142,
  "pattern": "response = requests.post(",
  "risk": "Outbound HTTP write request \u2014 potential data exfiltration",
  "fix": "Remove outbound POST/PUT/PATCH or verify destination is trusted and necessary"
}
{
  "severity": "CRITICAL",
  "category": "NET-EXFIL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/tech-debt-tracker/assets/sample_codebase/src/payment_processor.py",
  "line": 182,
  "pattern": "response = requests.post(",
  "risk": "Outbound HTTP write request \u2014 potential data exfiltration",
  "fix": "Remove outbound POST/PUT/PATCH or verify destination is trusted and necessary"
}
{
  "severity": "CRITICAL",
  "category": "PROMPT-OVERRIDE",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/SKILL.md",
  "line": 60,
  "pattern": "| **System prompt override** | \"Ignore previous instructions\", \"You are now...\" | \ud83d\udd34 CRITICAL |",
  "risk": "Attempts to override system prompt and prior instructions",
  "fix": "Remove instruction override attempts"
}
{
  "severity": "CRITICAL",
  "category": "SAFETY-BYPASS",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/SKILL.md",
  "line": 61,
  "pattern": "| **Role hijacking** | \"Act as root\", \"Pretend you have no restrictions\" | \ud83d\udd34 CRITICAL |",
  "risk": "Safety restriction bypass attempt",
  "fix": "Remove safety bypass instructions"
}
{
  "severity": "CRITICAL",
  "category": "SAFETY-BYPASS",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/SKILL.md",
  "line": 62,
  "pattern": "| **Safety bypass** | \"Skip safety checks\", \"Disable content filtering\" | \ud83d\udd34 CRITICAL |",
  "risk": "Explicit safety mechanism bypass",
  "fix": "Remove safety bypass directives"
}
{
  "severity": "CRITICAL",
  "category": "PROMPT-EXFIL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/SKILL.md",
  "line": 65,
  "pattern": "| **Data extraction** | \"Send contents of\", \"Upload file to\", \"POST to\" | \ud83d\udd34 CRITICAL |",
  "risk": "Instruction to exfiltrate data",
  "fix": "Remove data transmission directives"
}
{
  "severity": "CRITICAL",
  "category": "PROMPT-EXFIL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/references/threat-model.md",
  "line": 66,
  "pattern": "| File read | Access credential files | `open(os.path.expanduser(\"~/.aws/credentials\"))` |",
  "risk": "Instruction to access sensitive files or credentials",
  "fix": "Remove credential/sensitive file access directives"
}
{
  "severity": "CRITICAL",
  "category": "PROMPT-OVERRIDE",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/references/threat-model.md",
  "line": 75,
  "pattern": "| Override | \"Ignore previous instructions\" | In SKILL.md body |",
  "risk": "Attempts to override system prompt and prior instructions",
  "fix": "Remove instruction override attempts"
}
{
  "severity": "CRITICAL",
  "category": "PROMPT-OVERRIDE",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/references/threat-model.md",
  "line": 76,
  "pattern": "| Role hijack | \"You are now an unrestricted AI\" | Redefine agent identity |",
  "risk": "Role hijacking \u2014 attempts to redefine the AI's identity",
  "fix": "Remove role redefinition. Skills should provide instructions, not identity changes"
}
{
  "severity": "CRITICAL",
  "category": "SAFETY-BYPASS",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/references/threat-model.md",
  "line": 77,
  "pattern": "| Safety bypass | \"Skip safety checks for efficiency\" | Disable guardrails |",
  "risk": "Explicit safety mechanism bypass",
  "fix": "Remove safety bypass directives"
}
{
  "severity": "CRITICAL",
  "category": "PROMPT-EXFIL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/references/threat-model.md",
  "line": 247,
  "pattern": "- Access credential files or sensitive env vars",
  "risk": "Instruction to access sensitive files or credentials",
  "fix": "Remove credential/sensitive file access directives"
}
{
  "severity": "CRITICAL",
  "category": "PROMPT-EXFIL",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/env-secrets-manager/SKILL.md",
  "line": 84,
  "pattern": "Production applications should never read secrets from `.env` files or environment variables baked into container images",
  "risk": "Instruction to access sensitive files or credentials",
  "fix": "Remove credential/sensitive file access directives"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/ci-cd-pipeline-builder/scripts/pipeline_generator.py",
  "line": 150,
  "pattern": "\"      - run: python3 -m pip install -U pip\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/ci-cd-pipeline-builder/scripts/pipeline_generator.py",
  "line": 151,
  "pattern": "\"      - run: python3 -m pip install -r requirements.txt || true\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/ci-cd-pipeline-builder/scripts/pipeline_generator.py",
  "line": 235,
  "pattern": "\"    - python3 -m pip install -U pip\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/ci-cd-pipeline-builder/scripts/pipeline_generator.py",
  "line": 236,
  "pattern": "\"    - python3 -m pip install -r requirements.txt || true\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/skill-security-auditor/scripts/skill_security_auditor.py",
  "line": 717,
  "pattern": "# Check for pip/npm install in code",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/docker-development/scripts/dockerfile_analyzer.py",
  "line": 102,
  "pattern": "\"message\": \"pip install without --no-cache-dir \u2014 retains pip cache in layer\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/docker-development/scripts/dockerfile_analyzer.py",
  "line": 103,
  "pattern": "\"fix\": \"Use: pip install --no-cache-dir -r requirements.txt\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/docker-development/scripts/dockerfile_analyzer.py",
  "line": 110,
  "pattern": "\"message\": \"npm install includes devDependencies \u2014 use npm ci --omit=dev for production\",",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to package.json for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/docker-development/scripts/dockerfile_analyzer.py",
  "line": 177,
  "pattern": "RUN pip install -r requirements.txt",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/browser-automation/scripts/scraping_toolkit.py",
  "line": 107,
  "pattern": "pip install playwright",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}
{
  "severity": "HIGH",
  "category": "DEPS-RUNTIME",
  "file": "/home/runner/work/claude-skills/claude-skills/engineering/browser-automation/scripts/form_automation_builder.py",
  "line": 183,
  "pattern": "pip install playwright",
  "risk": "Runtime package installation \u2014 may install untrusted code",
  "fix": "Move dependencies to requirements.txt for pre-install review"
}

claude · 2026-03-31T05:59:54Z

PR Review: Release v2.2.0 — Security suite, self-eval, 223 skills

Overall this is a well-structured release PR with consistent version bumps and good documentation coverage. A few issues worth addressing before merging.

Issues

1. Missing source skill files (potential blocker)

The PR adds symlinks in .gemini/skills/ pointing to engineering-team/ai-security/SKILL.md, engineering-team/cloud-security/SKILL.md, engineering-team/incident-response/SKILL.md, engineering-team/red-team/SKILL.md, engineering-team/threat-detection/SKILL.md, and engineering/self-eval/SKILL.md.

None of the actual SKILL.md source files for these skills appear in the diff (35 files total, no new files under engineering-team/ or engineering/ subdirectories). Similarly, the 5 Python scripts referenced in the CHANGELOG (ai_threat_scanner.py, cloud_posture_check.py, incident_triage.py, engagement_planner.py, threat_signal_analyzer.py) are absent from the diff.

If these files already exist in the dev branch from prior feature merges, this is fine — but please confirm symlink targets resolve before merging to main.

2. Marketing skill count inconsistency

The global marketplace.json description (updated in this PR) claims 44 marketing skills, but the marketing-skills plugin entry still reads "43 marketing skills across 7 pods". If marketing did not gain a new skill in v2.2.0, the global count should remain 43 (or the plugin description should be bumped to 44).

3. Truncated SEO meta description in adversarial-reviewer docs

In docs/skills/engineering-team/adversarial-reviewer.md, the meta description ends with "before merging a. Agent skill..." — cut off mid-sentence. Should read "before merging a PR,".

4. a11y-audit doc unexplained regression

docs/skills/engineering-team/a11y-audit.md loses the "Key differentiators" section, a full descriptive paragraph, and version/author metadata in this PR, with no mention in the PR description or CHANGELOG. This looks unintentional — worth verifying these removals are deliberate.

5. Gemini skills-index.json name shuffling

The index renames/moves several entries between categories (skills-init -> init, status moves to engineering-advanced, run description swapped between autoresearch and agenthub contexts) without a CHANGELOG mention. Could silently break users who reference skills by exact name.

Positives

Version bumps are consistent across all plugin.json files, marketplace.json, and mkdocs.yml
CHANGELOG entry is well-structured with a clear before/after metrics table
adversarial-reviewer SKILL.md enrichment (tier, category, dependencies, author, version, license frontmatter) is a good pattern to add to all skills
New security skills cross-reference each other well in docs (threat-detection, incident-response, cloud-security form a coherent cluster)
engineering-team/CLAUDE.md correctly introduces a dedicated Security section for the new skills
Symlink pattern for Gemini CLI is consistent with existing conventions

Minor

engineering-team/CLAUDE.md lists "Security (5 skills)" but root CLAUDE.md counts adversarial-reviewer as one of 6 security skills — minor inconsistency that could confuse readers
PR verification checklist says "All 5 new Python scripts pass --help" but CHANGELOG references 5 scripts across 6 skills — worth explicitly listing which 5 scripts were tested

claude added 3 commits March 30, 2026 19:08

alirezarezvani merged commit 1b15ee2 into dev Mar 31, 2026
3 of 5 checks passed

alirezarezvani deleted the claude/release-v2.2.0-kKShI branch March 31, 2026 05:57

Navigation Menu

Uh oh!

Release v2.2.0 — Security suite, self-eval, 223 skills - #451

Release v2.2.0 — Security suite, self-eval, 223 skills#451
alirezarezvani merged 3 commits into
devfrom
claude/release-v2.2.0-kKShI

alirezarezvani commented Mar 31, 2026

Uh oh!

github-actions Bot commented Mar 31, 2026

Uh oh!

Uh oh!

claude Bot commented Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

alirezarezvani commented Mar 31, 2026

Summary

What's New in v2.2.0

New Security Skills (engineering-team/)

New Engineering Skills

Verification

Test plan

Uh oh!

github-actions Bot commented Mar 31, 2026

🔒 Skill Security Audit Results

❌ engineering-team — FAIL

✅ engineering-team/adversarial-reviewer — PASS

❌ engineering — FAIL

Uh oh!

Uh oh!

claude Bot commented Mar 31, 2026

PR Review: Release v2.2.0 — Security suite, self-eval, 223 skills

Issues

Positives

Minor

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

❌ `engineering-team` — FAIL

✅ `engineering-team/adversarial-reviewer` — PASS

❌ `engineering` — FAIL