skills.rest
project-ax
project-axOFFICIAL
Explore all skills by this author →
GitHub

security-checklist

Generate a structured PR security review covering sandbox, injection, and supply chain risks.

1|Updated Apr 23, 2026
Search Tags:#security review#prompt injection#supply chain#capability minimization#sandbox boundaries#plugin IPC#secure PR
One-click install
npx skills add https://github.com/project-ax/ax-next --skill security-checklist-project-ax
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-checklist
Source: https://github.com/project-ax/ax-next/tree/main/.claude/skills/security-checklist
Command: npx skills add https://github.com/project-ax/ax-next --skill security-checklist-project-ax

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents capability leaks, injection paths, and supply-chain risks when code changes touch sandbox boundaries, IPC/plugin surfaces, untrusted strings, file paths, process spawning, or network access.

Core Features & Use Cases

  • Rigid security review for specific change triggers: Runs when relevant areas are touched (hook/IPC/plugin manifests, payloads with model/tool/external output, new dependencies, filesystem/process/network access, plugin exposed surfaces).
  • Three threat models in one note: Evaluates sandbox escape/capability leakage, prompt injection/untrusted content flows, and supply chain from package.json changes.
  • Structured PR output contract: Produces a concise “## Security review” block with explicit “N/A: <reason>” coverage and mandatory reasoning for every section.

Quick Start

Use this skill by reviewing a PR diff that adds a new dependency or modifies IPC/plugin loading, then paste the generated structured “## Security review” checklist into your pull request description.

Frequently Asked Questions about security-checklist

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a security review to a pull request that modifies plugin IPC loading?▼

A PR security review for IPC loading changes verifies sandbox capability minimization, untrusted content flow safety, and supply-chain risk. It produces a contract-ready security review block covering sandbox boundaries, prompt injection, and supply chain threats.

What is capability minimization and how does it prevent sandbox escape in hook payloads?▼

Capability minimization prevents sandbox escape by restricting hook payload handling to only necessary permissions. When code changes touch hook bus signatures or IPC transport, evaluating this threat model ensures untrusted content flows safely without leaking boundary privileges.

How do I perform a supply chain security check for new package.json dependencies?▼

Perform a supply chain security check for package.json changes by evaluating new dependency risks within a structured PR note. The review walks three threat models in order, requiring justified N/A cases for sandbox, injection, and supply chain sections.

Does my PR need a prompt injection review if it handles external model outputs?▼

Yes, PRs handling external model outputs require a prompt injection review. The security checklist evaluates untrusted content flows to ensure external strings cannot manipulate plugin exposed surfaces, file path usage, or process spawning.

What is the best way to document N/A security checks for network connection changes?▼

Document N/A security checks using the structured PR security block with explicit “N/A: <reason>” coverage. Mandatory detailed answers with justified reasoning must be provided for every section covering sandbox, injection, and supply chain.

When should I not use an automated PR security checklist for file path modifications?▼

An automated PR security checklist should not replace manual review when file path modifications involve complex filesystem permissions outside sandbox boundaries. It targets specific change triggers like hook payloads, IPC transport, and process spawning, requiring manual assessment for uncovered edge cases.

Related Skills

Explore More Legal & Compliance Skills→
project-axproject-ax
1

ax-conventions

Enforce AX plugin and hook design rules for safe coupling and boundaries.

Official
Advanced
ka2kamaka2kama
2

review-and-merge

Automate pull request review, feedback handling, and merge execution.

Community
Advanced
martinholovskymartinholovsky
12

sota-sandboxing

Implement sandboxing and isolation strategies for untrusted code execution.

Community
Advanced
oguzhantopguloguzhantopgul
8

skill-security-reviewer

Analyze agent skills for security threats and generate structured reports.

Community
Advanced