skills.rest
wandreandrade2018-maker
wandreandrade2018-makerCOMMUNITY
Explore all skills by this author →
GitHub

V3 Security Overhaul

Remediates critical CVEs and implements secure-by-default patterns for claude-flow v3.

Updated Aug 18, 2026
Search Tags:#security#npm audit#bcrypt#claude-flow#path traversal#zod validation#cve remediation
One-click install
npx skills add https://github.com/wandreandrade2018-maker/claude-config --skill v3-security-overhaul-wandreandrade2018-maker
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: V3 Security Overhaul
Source: https://github.com/wandreandrade2018-maker/claude-config/tree/main/.claude/skills/v3-security-overhaul
Command: npx skills add https://github.com/wandreandrade2018-maker/claude-config --skill v3-security-overhaul-wandreandrade2018-maker

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bcrypt, zod.

What problem does it solve? It addresses critical security vulnerabilities in claude-flow v3, including vulnerable dependencies, weak password hashing, and hardcoded credentials, by orchestrating a structured security overhaul. ## Core Features & Use Cases - CVE Remediation: Fixes CVE-1 (vulnerable npm dependencies), CVE-2 (SHA-256 password hashing replaced with bcrypt at 12 rounds), and CVE-3 (hardcoded credentials replaced with crypto-generated random keys). - Secure Coding Patterns: Provides Zod-based input validation, path traversal sanitization, and shell-free command execution via execFile. - Agent Orchestration: Coordinates v3-security-architect, security-auditor, and test-architect agents in parallel for threat modeling, auditing, and TDD security testing. - Use Case: When upgrading claude-flow to v3, run this overhaul to reach a 90/100 security score, resolve all critical CVEs, and achieve over 95% test coverage on security-critical code. ## Quick Start Ask the AI to run the v3 security overhaul to fix CVE-1, CVE-2, and CVE-3 and apply the secure-by-default patterns to the claude-flow codebase.

Frequently Asked Questions about V3 Security Overhaul

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix critical CVEs in claude-flow v3?▼

Update @anthropic-ai/claude-code to version 2.0.31 or higher and run npm audit at the high level for CVE-1. Replace SHA-256 password hashing with bcrypt at 12 rounds for CVE-2, and generate credentials with crypto.randomBytes for CVE-3.

How to replace SHA-256 password hashing with bcrypt in Node.js?▼

Import bcrypt and call bcrypt.hash with the password and 12 salt rounds instead of using crypto.createHash with a hardcoded salt. This provides adaptive hashing resistant to brute-force attacks.

How do I prevent path traversal attacks in Node.js?▼

Resolve the user-supplied path against an allowed prefix using path.resolve, then verify the result still starts with the resolved prefix. Throw an error if the check fails to block directory escape attempts.

Does this skill validate user input automatically?▼

Yes, it uses Zod schemas to validate inputs such as taskId as UUID, content length limits, and enumerated agent types. Invalid payloads are rejected before reaching execution logic.

Why is execFile safer than exec for running commands?▼

execFile runs the binary directly with shell set to false, so user input is passed as arguments without shell interpretation. This eliminates shell injection risks that exist when using exec with string concatenation.

Related Skills

Explore More Software Engineering Skills→
ishandutta2007ishandutta2007
11

V3 Security Overhaul

Remediates critical CVEs and implements secure-by-default patterns for claude-flow v3.

Community
Intermediate
LLM-Dev-OpsLLM-Dev-Ops
1

V3 Security Overhaul

Audit and harden claude-flow v3 security architecture across CI/CD stages.

Official
Advanced
patricio0312revpatricio0312rev
5

secrets-scanner

Detect leaked credentials in codebases across pre-commit hooks and CI pipelines.

Community
Advanced
7a336e6e7a336e6e
1

implementing-local-auth

Implement local user authentication with bcrypt hashing and JWT issuance.

Community
Advanced