Rafter
Community@Raftersecurity
Rafter provides security review skills for code diffs, third-party agent assets, and secure design, covering SAST, SCA, secrets detection, and OWASP/ASVS/MITRE checks.
Agent Skills by Rafter
Showing 4 vetted skills indexed across 1 GitHub repositories.
Raftersecurityrafter
Scan code for secrets, SAST findings, and vulnerable dependencies via the Rafter CLI.
Raftersecurityrafter-code-review
Guides structured security code reviews using OWASP, ASVS, and MITRE CWE checklists.
Raftersecurityrafter-skill-review
Vet third-party SKILL.md files and agent configs for malware, prompt injection, and data exfiltration before installation.
Raftersecurityrafter-secure-design
Guides security design reviews for features touching auth, data, APIs, ingestion, and deployment.
Frequently Asked Questions About Rafter
FAQPage SchemaWhat tasks can I accomplish using Rafter's skills?▼
Rafter skills run remote SAST+SCA scans (`rafter run`), local secrets-only scans (`rafter secrets`), audits, policy checks, and command-risk evaluation. They also guide OWASP/ASVS/MITRE code review on sensitive diffs, vet third-party agent assets before installation, and enforce secure design review before writing code touching auth, payments, tokens, or user data.
Who should use Rafter's security skills?▼
Engineers and reviewers working on diffs that touch auth, credentials, untrusted input, SQL, shell/exec, file paths, deserialization, crypto, network endpoints, data deletion, or dependencies. It also targets anyone installing third-party SKILL.md files, MCP manifests, Cursor rules, or agent configs, which grant Read/Bash/network under their identity.
When should Rafter skills be invoked during development?▼
Invoke rafter before handing off any task with genuine security surface, run rafter-code-review plus `rafter run` before declaring such a diff done, run rafter-skill-review before installing any third-party agent asset, and run rafter-secure-design before writing code for features touching auth, payments, sessions, or user data.
What permissions do Rafter skills require?▼
Permissions vary by skill: rafter uses Bash and Read; rafter-code-review uses Bash, Read, Glob, and Grep; rafter-skill-review adds WebFetch for vetting remote assets; rafter-secure-design is read-only with Read, Glob, and Grep. Research or local-only code without security surface can skip with a quick surface check.
Is Rafter free or open source?▼
The provided manifest does not state licensing or pricing for Rafter's skills. Rafter publishes 6 public repositories under the Raftersecurity organization, with skill versions 0.7.0 and 0.1.0 listed. Check https://rafter.so or the public repositories for current license and cost terms.