Agent Skills
› backbay-labs/clawdstrike
› security-review
security-review
GitHub用于审查涉及敏感路径、密钥、依赖及配置变更的代码风险，通过策略检查工具确保操作合规。
Trigger Scenarios
触及安全敏感路径的多文件编辑
修改系统状态的Shell命令
新增或变更依赖包
CI/CD或基础设施配置变更
涉及密钥、凭证等关键词的内容
Install
npx skills add backbay-labs/clawdstrike --skill security-review -g -y
SKILL.md
Frontmatter
{
"name": "security-review",
"description": "Security review for risky code changes"
}
Security Review
Security Checklist
Before proceeding with risky actions, use the clawdstrike_check MCP tool to verify policy compliance:
- Pre-flight check: Call
clawdstrike_checkwith the action_type and target before executing - Secret scanning: Verify no secrets, API keys, or credentials are being written to files
- Dependency audit: For new dependencies, check for known vulnerabilities
- Permission scope: Ensure file operations stay within allowed paths
- Shell safety: Validate shell commands against the ShellCommandGuard policy
Action Type Mapping
Use these action_type values when calling clawdstrike_check:
| Scenario | action_type | target |
|---|---|---|
| Writing/reading files | file |
Absolute file path |
| Running shell commands | shell |
The command string |
| HTTP/network requests | egress |
Domain or URL |
| Installing packages | shell |
Install command |
| MCP tool invocation | mcp_tool |
Tool name |
Response Guidelines
When this skill is active:
- Proactively call
clawdstrike_checkbefore file writes to sensitive paths - Flag potential security issues with severity levels (Critical/High/Medium/Low)
- Suggest safer alternatives when an action would be blocked by policy
- Reference specific guards that would evaluate the action
Recommended Tools
Use these MCP tools in order of priority when this skill activates:
| Tool | When to Use |
|---|---|
clawdstrike_check |
Before any file write, shell command, or egress -- the primary enforcement tool |
clawdstrike_policy_eval |
To test hypothetical actions without executing them -- use for planning |
clawdstrike_policy_show |
To understand which guards are active and what the current restrictions are |
clawdstrike_scan |
To audit all MCP server configs for misconfigurations before a review |
clawdstrike_policy_lint |
To validate policy YAML files for syntax/schema errors |
Guard Reference
These guards are evaluated during checks:
- ForbiddenPathGuard - Blocks access to sensitive filesystem paths
- PathAllowlistGuard - Enforces allowlist-based path access
- SecretLeakGuard - Detects secrets/credentials in file content
- ShellCommandGuard - Blocks dangerous shell commands
- EgressAllowlistGuard - Controls outbound network access
- PatchIntegrityGuard - Validates patch/diff safety
Version History
- 666303e Current 2026-07-25 09:08
