{"owner":"sebastienros","repo":"security","hasSkills":true,"totalSkillsCount":4,"totalTokensCount":1434,"categories":["mcp-config","marketplace","plugin-manifest","cursor-rule"],"hasMcp":true,"mcpConfig":{"mcpServers":{"security":{"command":"npx","args":["-y","@modelcontextprotocol/server-security"]}}},"found":[".cursor/mcp.json",".claude-plugin/marketplace.json",".claude-plugin/plugin.json",".cursorrules (security-devsecops-ssdls-appsec.mdc)"],"skills":{".cursor/mcp.json":"# Model Context Protocol (MCP) Configuration\n\nPath: `.cursor/mcp.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.cursor/mcp.json)",".claude-plugin/marketplace.json":"# Claude Plugin Marketplace Catalog\n\nPath: `.claude-plugin/marketplace.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/marketplace.json)",".claude-plugin/plugin.json":"# claude-plugin Plugin Manifest\n\nPath: `.claude-plugin/plugin.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/plugin.json)",".cursorrules (security-devsecops-ssdls-appsec.mdc)":"# DevSecOps + SSDLC + AppSec Cursor Rule\n\n## General Security Principles\n- Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.\n- Prohibit the inclusion of `.env`, secret config files, or unknown tokens in source control.\n- Never log sensitive data, secrets, or session tokens in application logs.\n- Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.\n- Avoid unsafe functions such as `exec`, `eval`, or similar dynamic code execution.\n\n## Database Security\n- Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.\n- Ensure database users have the least privilege required for their tasks.\n- Regularly review and update database access policies.\n\n## Dependency Management\n- Only use packages from verified sources.\n- Do not add new dependencies without explicit approval and security review.\n- Regularly update dependencies and scan for known vulnerabilities (SCA).\n\n## Authentication & Authorization\n- Use secure authentication frameworks; never implement custom authentication.\n- Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).\n- Implement Role-Based Access Control (RBAC) for sensitive operations.\n- Enforce the principle of least privilege for APIs and UI actions.\n\n## Secure SDLC Practices\n- Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.\n- Scan all code for secrets before merging (Secret Scanning).\n- Use Infrastructure as Code (IaC) scanning for all infrastructure code.\n- Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.\n- Enforce Policy as Code (PaC) for automated, version-controlled security policies.\n\n## Monitoring & Feedback\n- Enable continuous vulnerability monitoring and alerting.\n- Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.\n- Encourage regular vulnerability assessments and penetration testing.\n- Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.\n\n## Compliance & Documentation\n- Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).\n- Document all security controls and decisions for auditability."},"files":{".cursor/mcp.json":"# Model Context Protocol (MCP) Configuration\n\nPath: `.cursor/mcp.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.cursor/mcp.json)",".claude-plugin/marketplace.json":"# Claude Plugin Marketplace Catalog\n\nPath: `.claude-plugin/marketplace.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/marketplace.json)",".claude-plugin/plugin.json":"# claude-plugin Plugin Manifest\n\nPath: `.claude-plugin/plugin.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/plugin.json)",".cursorrules (security-devsecops-ssdls-appsec.mdc)":"# DevSecOps + SSDLC + AppSec Cursor Rule\n\n## General Security Principles\n- Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.\n- Prohibit the inclusion of `.env`, secret config files, or unknown tokens in source control.\n- Never log sensitive data, secrets, or session tokens in application logs.\n- Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.\n- Avoid unsafe functions such as `exec`, `eval`, or similar dynamic code execution.\n\n## Database Security\n- Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.\n- Ensure database users have the least privilege required for their tasks.\n- Regularly review and update database access policies.\n\n## Dependency Management\n- Only use packages from verified sources.\n- Do not add new dependencies without explicit approval and security review.\n- Regularly update dependencies and scan for known vulnerabilities (SCA).\n\n## Authentication & Authorization\n- Use secure authentication frameworks; never implement custom authentication.\n- Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).\n- Implement Role-Based Access Control (RBAC) for sensitive operations.\n- Enforce the principle of least privilege for APIs and UI actions.\n\n## Secure SDLC Practices\n- Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.\n- Scan all code for secrets before merging (Secret Scanning).\n- Use Infrastructure as Code (IaC) scanning for all infrastructure code.\n- Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.\n- Enforce Policy as Code (PaC) for automated, version-controlled security policies.\n\n## Monitoring & Feedback\n- Enable continuous vulnerability monitoring and alerting.\n- Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.\n- Encourage regular vulnerability assessments and penetration testing.\n- Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.\n\n## Compliance & Documentation\n- Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).\n- Document all security controls and decisions for auditability."},"items":[{"name":"marketplace.json","path":".claude-plugin/marketplace.json","rawUrl":"https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/marketplace.json","title":"Claude Plugin Marketplace Catalog","category":"marketplace","format":"json","content":"# Claude Plugin Marketplace Catalog\n\nPath: `.claude-plugin/marketplace.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/marketplace.json)","tokens":300,"sizeBytes":200},{"name":"plugin.json","path":".claude-plugin/plugin.json","rawUrl":"https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/plugin.json","title":"claude-plugin Plugin Manifest","category":"plugin-manifest","format":"json","content":"# claude-plugin Plugin Manifest\n\nPath: `.claude-plugin/plugin.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/plugin.json)","tokens":300,"sizeBytes":186},{"name":"mcp.json","path":".cursor/mcp.json","rawUrl":"https://raw.githubusercontent.com/sebastienros/security/HEAD/.cursor/mcp.json","title":"Model Context Protocol (MCP) Configuration","category":"mcp-config","format":"json","content":"# Model Context Protocol (MCP) Configuration\n\nPath: `.cursor/mcp.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.cursor/mcp.json)","tokens":300,"sizeBytes":179},{"name":".cursorrules","path":".cursorrules (security-devsecops-ssdls-appsec.mdc)","rawUrl":"https://raw.githubusercontent.com/PatrickJS/awesome-cursorrules/main/rules/security-devsecops-ssdls-appsec.mdc","title":"Cursor rules for secure coding, secret handling, dependency hygiene, authentication, authorization, security testing, and compliance documentation.","category":"cursor-rule","format":"markdown","content":"# DevSecOps + SSDLC + AppSec Cursor Rule\n\n## General Security Principles\n- Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.\n- Prohibit the inclusion of `.env`, secret config files, or unknown tokens in source control.\n- Never log sensitive data, secrets, or session tokens in application logs.\n- Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.\n- Avoid unsafe functions such as `exec`, `eval`, or similar dynamic code execution.\n\n## Database Security\n- Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.\n- Ensure database users have the least privilege required for their tasks.\n- Regularly review and update database access policies.\n\n## Dependency Management\n- Only use packages from verified sources.\n- Do not add new dependencies without explicit approval and security review.\n- Regularly update dependencies and scan for known vulnerabilities (SCA).\n\n## Authentication & Authorization\n- Use secure authentication frameworks; never implement custom authentication.\n- Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).\n- Implement Role-Based Access Control (RBAC) for sensitive operations.\n- Enforce the principle of least privilege for APIs and UI actions.\n\n## Secure SDLC Practices\n- Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.\n- Scan all code for secrets before merging (Secret Scanning).\n- Use Infrastructure as Code (IaC) scanning for all infrastructure code.\n- Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.\n- Enforce Policy as Code (PaC) for automated, version-controlled security policies.\n\n## Monitoring & Feedback\n- Enable continuous vulnerability monitoring and alerting.\n- Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.\n- Encourage regular vulnerability assessments and penetration testing.\n- Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.\n\n## Compliance & Documentation\n- Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).\n- Document all security controls and decisions for auditability.","frontmatter":{"description":"Cursor rules for secure coding, secret handling, dependency hygiene, authentication, authorization, security testing, and compliance documentation.","globs":["**/*.py","**/*.js","**/*.ts","**/*.go","**/*.java","**/*.rb","**/*.php","**/*.cs","**/*.sh"],"alwaysApply":true},"tokens":534,"sizeBytes":2318}],"systemPromptSnippet":"<yakaai_skills repo=\"sebastienros/security\">\n<!-- File: .claude-plugin/marketplace.json (Tokens: ~300 | Category: marketplace) -->\n# Claude Plugin Marketplace Catalog\n\nPath: `.claude-plugin/marketplace.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/marketplace.json)\n\n<!-- File: .claude-plugin/plugin.json (Tokens: ~300 | Category: plugin-manifest) -->\n# claude-plugin Plugin Manifest\n\nPath: `.claude-plugin/plugin.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.claude-plugin/plugin.json)\n\n<!-- File: .cursor/mcp.json (Tokens: ~300 | Category: mcp-config) -->\n# Model Context Protocol (MCP) Configuration\n\nPath: `.cursor/mcp.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/sebastienros/security/HEAD/.cursor/mcp.json)\n\n<!-- File: .cursorrules (security-devsecops-ssdls-appsec.mdc) (Tokens: ~534 | Category: cursor-rule) -->\n# DevSecOps + SSDLC + AppSec Cursor Rule\n\n## General Security Principles\n- Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.\n- Prohibit the inclusion of `.env`, secret config files, or unknown tokens in source control.\n- Never log sensitive data, secrets, or session tokens in application logs.\n- Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.\n- Avoid unsafe functions such as `exec`, `eval`, or similar dynamic code execution.\n\n## Database Security\n- Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.\n- Ensure database users have the least privilege required for their tasks.\n- Regularly review and update database access policies.\n\n## Dependency Management\n- Only use packages from verified sources.\n- Do not add new dependencies without explicit approval and security review.\n- Regularly update dependencies and scan for known vulnerabilities (SCA).\n\n## Authentication & Authorization\n- Use secure authentication frameworks; never implement custom authentication.\n- Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).\n- Implement Role-Based Access Control (RBAC) for sensitive operations.\n- Enforce the principle of least privilege for APIs and UI actions.\n\n## Secure SDLC Practices\n- Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.\n- Scan all code for secrets before merging (Secret Scanning).\n- Use Infrastructure as Code (IaC) scanning for all infrastructure code.\n- Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.\n- Enforce Policy as Code (PaC) for automated, version-controlled security policies.\n\n## Monitoring & Feedback\n- Enable continuous vulnerability monitoring and alerting.\n- Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.\n- Encourage regular vulnerability assessments and penetration testing.\n- Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.\n\n## Compliance & Documentation\n- Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).\n- Document all security controls and decisions for auditability.\n</yakaai_skills>"}