forge-security-review
Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web trigger hardening, or static analysis execution for a Forge app.
- License
- Apache-2.0
Pinned to revision 294b53da6b20, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/forge-security-review/SKILL.md
- skills/forge-security-review/README.md
- skills/forge-security-review/assets/security-rules/_global-forge.mdc
- skills/forge-security-review/assets/security-rules/forge-auditing/_index-auditing.mdc
- skills/forge-security-review/assets/security-rules/forge-auditing/static-analysis-forge.mdc
- skills/forge-security-review/assets/security-rules/forge-authn-authz/_index-authn-authz.mdc
- skills/forge-security-review/assets/security-rules/forge-authn-authz/asapp-privilege-escalation.mdc
- skills/forge-security-review/assets/security-rules/forge-authn-authz/display-conditions-bypass.mdc
- skills/forge-security-review/assets/security-rules/forge-authn-authz/missing-resolver-authz.mdc
- skills/forge-security-review/assets/security-rules/forge-authn-authz/prefer-context-authz.mdc
- skills/forge-security-review/assets/security-rules/forge-egress-remotes/_index-egress-remotes.mdc
- skills/forge-security-review/assets/security-rules/forge-egress-remotes/data-egress-redirects.mdc
- skills/forge-security-review/assets/security-rules/forge-egress-remotes/wildcard-permissions.mdc
- skills/forge-security-review/assets/security-rules/forge-injection/_index-injection.mdc
- skills/forge-security-review/assets/security-rules/forge-injection/prototype-pollution.mdc
- skills/forge-security-review/assets/security-rules/forge-injection/rce-code-execution.mdc
- skills/forge-security-review/assets/security-rules/forge-injection/sql-injection.mdc
- skills/forge-security-review/assets/security-rules/forge-injection/ssrf.mdc
- skills/forge-security-review/assets/security-rules/forge-injection/xss.mdc
- skills/forge-security-review/assets/security-rules/forge-manifest-config/_index-manifest-config.mdc
- skills/forge-security-review/assets/security-rules/forge-manifest-config/content-security-policy.mdc
- skills/forge-security-review/assets/security-rules/forge-manifest-config/egress-url-entries.mdc
- skills/forge-security-review/assets/security-rules/forge-manifest-config/permission-scopes.mdc
- skills/forge-security-review/assets/security-rules/forge-misc/_index-misc.mdc
- skills/forge-security-review/assets/security-rules/forge-misc/software-composition.mdc
- skills/forge-security-review/assets/security-rules/forge-rovo-agents/_index-rovo-agents.mdc
- skills/forge-security-review/assets/security-rules/forge-rovo-agents/agent-privilege-escalation.mdc
- skills/forge-security-review/assets/security-rules/forge-secrets-storage/_index-secrets-storage.mdc
- skills/forge-security-review/assets/security-rules/forge-secrets-storage/hardcoded-secrets.mdc
- skills/forge-security-review/assets/security-rules/forge-tenant-isolation/_index-tenant-isolation.mdc
- skills/forge-security-review/assets/security-rules/forge-tenant-isolation/global-state-warmstart.mdc
- skills/forge-security-review/assets/security-rules/forge-webtrigger-entrypoints/_index-webtrigger-entrypoints.mdc
- skills/forge-security-review/assets/security-rules/forge-webtrigger-entrypoints/webtrigger-security.mdc
- skills/forge-security-review/scripts/.gitignore
- skills/forge-security-review/scripts/run_static_analysis.ps1
- skills/forge-security-review/scripts/run_static_analysis.sh
Every link opens the file at its source, pinned to the revision this page describes.