security-review

Automate charm-specific security reviews for Juju BUILD tasks.

1|Updated Feb 8, 2026

Search Tags:#security #vulnerabilities #charm #best-practices #code-review #subprocess #juju

Ready to run

npx skills add https://github.com/tonyandrewmeyer/cantrip --skill security-review-tonyandrewmeyer

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/tonyandrewmeyer/cantrip/tree/main/src/cantrip/skills/security-review
Command: npx skills add https://github.com/tonyandrewmeyer/cantrip --skill security-review-tonyandrewmeyer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Charm development often introduces security issues during BUILD tasks; this skill provides a structured security review to catch common charm-specific issues before completion.

Core Features & Use Cases

Automated checks: identifies common pitfalls in shell usage, path handling, and data handling.
Guided remediation: surfaces actionable fixes and risk levels to the user.
Use Case: integral in CI pipelines to prevent insecure charms from being released.

Quick Start

Run the security-review task on your charm build to surface issues before finishing BUILD.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a security review on a Juju charm before building?▼

To run a security review on a Juju charm, execute the security-review task on your build to surface common vulnerabilities before finishing. It automates checks for shell injection, path traversal, and credential handling directly in your development workflow.

What common security vulnerabilities are checked during a charm build?▼

A charm security review checks for common vulnerabilities including shell injection, path traversal, credentials handling, SSRF, broad exception handling, and logging hygiene. It classifies these findings by risk level and provides clear remediation guidance.

Can I integrate automated security checks into my charm CI pipelines?▼

Yes, you can integrate automated security checks into charm CI pipelines to prevent insecure charms from being released. The security review task validates code, shell interactions, and configuration data during the build process.

Does the security review cover Python code and shell interactions in charms?▼

Yes, the security review covers Python code, shell interactions, and configuration data in charms. It identifies common pitfalls in shell usage, path handling, and data handling to ensure secure charm development.

How are security findings classified and remediated for charm builds?▼

Security findings for charm builds are classified by risk level with clear remediation guidance surfaced to the user. This structured approach provides actionable fixes for identified issues before the build task completes.

When do I need to perform a pre-build security review for Juju charms?▼

You need to perform a pre-build security review for Juju charms when development introduces potential security issues during BUILD tasks. This catches common charm-specific vulnerabilities early in manual builds or CI pipelines.