forge-security-review
Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web trigger hardening, or static analysis execution for a Forge app.
- License
- Apache-2.0
Pinned to revision 4e8964e24a5a, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/forge-security-review/SKILL.md
- skills/forge-security-review/LICENSE
- skills/forge-security-review/README.md
- skills/forge-security-review/assets/security-rules/_global-forge.md
- skills/forge-security-review/assets/security-rules/forge-auditing/_index-auditing.md
- skills/forge-security-review/assets/security-rules/forge-auditing/static-analysis-forge.md
- skills/forge-security-review/assets/security-rules/forge-authn-authz/_index-authn-authz.md
- skills/forge-security-review/assets/security-rules/forge-authn-authz/asapp-privilege-escalation.md
- skills/forge-security-review/assets/security-rules/forge-authn-authz/display-conditions-bypass.md
- skills/forge-security-review/assets/security-rules/forge-authn-authz/missing-resolver-authz.md
- skills/forge-security-review/assets/security-rules/forge-authn-authz/prefer-context-authz.md
- skills/forge-security-review/assets/security-rules/forge-egress-remotes/_index-egress-remotes.md
- skills/forge-security-review/assets/security-rules/forge-egress-remotes/data-egress-redirects.md
- skills/forge-security-review/assets/security-rules/forge-egress-remotes/wildcard-permissions.md
- skills/forge-security-review/assets/security-rules/forge-injection/_index-injection.md
- skills/forge-security-review/assets/security-rules/forge-injection/prototype-pollution.md
- skills/forge-security-review/assets/security-rules/forge-injection/rce-code-execution.md
- skills/forge-security-review/assets/security-rules/forge-injection/sql-injection.md
- skills/forge-security-review/assets/security-rules/forge-injection/ssrf.md
- skills/forge-security-review/assets/security-rules/forge-injection/xss.md
- skills/forge-security-review/assets/security-rules/forge-manifest-config/_index-manifest-config.md
- skills/forge-security-review/assets/security-rules/forge-manifest-config/content-security-policy.md
- skills/forge-security-review/assets/security-rules/forge-manifest-config/egress-url-entries.md
- skills/forge-security-review/assets/security-rules/forge-manifest-config/permission-scopes.md
- skills/forge-security-review/assets/security-rules/forge-misc/_index-misc.md
- skills/forge-security-review/assets/security-rules/forge-misc/software-composition.md
- skills/forge-security-review/assets/security-rules/forge-rovo-agents/_index-rovo-agents.md
- skills/forge-security-review/assets/security-rules/forge-rovo-agents/agent-privilege-escalation.md
- skills/forge-security-review/assets/security-rules/forge-secrets-storage/_index-secrets-storage.md
- skills/forge-security-review/assets/security-rules/forge-secrets-storage/hardcoded-secrets.md
- skills/forge-security-review/assets/security-rules/forge-tenant-isolation/_index-tenant-isolation.md
- skills/forge-security-review/assets/security-rules/forge-tenant-isolation/global-state-warmstart.md
- skills/forge-security-review/assets/security-rules/forge-webtrigger-entrypoints/_index-webtrigger-entrypoints.md
- skills/forge-security-review/assets/security-rules/forge-webtrigger-entrypoints/webtrigger-security.md
- skills/forge-security-review/scripts/.gitignore
- skills/forge-security-review/scripts/run_static_analysis.ps1
- skills/forge-security-review/scripts/run_static_analysis.sh
Every link opens the file at its source, pinned to the revision this page describes.