SkillsAdd

atlassian/forge-skills

forge-security-review

Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web trigger hardening, or static analysis execution for a Forge app.

Hot #2921 First seen Jun 9, 2026

Installation

$ npx skills add atlassian/forge-skills --skill forge-security-review
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

firebase-security-rules-auditor Similar name
firebase/agent-skills

>- Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege esc…

111K installs
better-auth-security-best-practices Similar name
better-auth/skills

Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, s…

30.3K installs
firestore-security-rules-auditor Similar name
firebase/agent-skills 20.4K installs
security-review Similar name
getsentry/skills

Security code review for vulnerabilities.

15.5K installs
security-best-practices Similar name
openai/skills

Perform language and framework specific security best-practice reviews and suggest improvements…

8.2K installs
security-threat-model Similar name
openai/skills

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabili…

5.4K installs

Also in this package

Other skills from atlassian/forge-skills.

npx skills add atlassian/forge-skills
forge-app-builder 333 forge-app-review 320 forge-debugger 316 forge-connector 243 forge-cost-optimizer 201

Browse all from atlassian/forge-skills

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 22
License LICENSE
Default branch main
Open issues 2
Status Active

Skill metadata

Parsed from SKILL.md frontmatter.

LicenseApache-2.0
More metadata
labels
forge,security,review,audit,atlassian
maintainer
atlassian-developer
namespace
cloud

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 6,714 B
  • docs README.md 3,344 B
  • docs SUMMARY.md 389 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 209 installs

SKILL.md

Forge Security Review

Runs a Forge-focused white-box security review and reports validated findings with exploitability, impact, evidence, and remediation guidance.

Token-Efficient Default

Use manifest-driven routing by default to reduce token usage. Do not load every rule file up front.

Rule Assets

The review rules are packaged with this skill under assets/security-rules/:

  • Global baseline: assets/security-rules/_global-forge.mdc
  • Category indexes: assets/security-rules/forge-/_index-.mdc
  • Category deep checks: assets/security-rules/forge-/.mdc

Execution Mandate

When this skill is triggered:

  1. Run static analysis first from this skill directory:

- scripts/runstaticanalysis.sh <forge-project-root-directory> - use .ps1 script for windows

  1. Read manifest.yml first before any deep code review.
  2. Load assets/security-rules/_global-forge.mdc first.
  3. Load only relevant category index rules based on manifest and code signals.
  4. Load deep subrules only when the matching detection heuristics are triggered by real code patterns.
  5. Perform an evidence-based security review across:

- AuthN/AuthZ - Injection and input validation - Tenant isolation and cross-tenant leakage - Secrets and storage - Egress/remotes/CSP and manifest permissions - Public entry points (web triggers) - Agent and miscellaneous Forge security risks

  1. Do not modify app code unless the user explicitly requests fixes.
  2. Write all scan outputs and generated artifacts to security-audit-artifacts/.

Rule Routing Workflow

Phase 1: Reconnaissance (Mandatory)

Read manifest.yml first and extract:

  • permissions.scopes
  • permissions.external.fetch
  • permissions.content.scripts
  • modules (resolver/webtrigger/scheduledTrigger/rovo/etc.)
  • remotes
  • app.runtime.name

Build an execution map:

  • UI modules -> bridge calls -> resolvers/functions
  • External entry points (web triggers, events, schedules)
  • api.asUser() vs api.asApp() paths
  • Outbound fetch destinations

Phase 2: Index Rule Selection (Two-Tier Loading)

Always load first:

  • assets/security-rules/_global-forge.mdc

Then load only relevant category index rules:

Signal Load
Any meaningful scope usage, mutations, or asApp() usage assets/security-rules/forge-authn-authz/_index-authn-authz.mdc
webtrigger or scheduledTrigger modules assets/security-rules/forge-webtrigger-entrypoints/_index-webtrigger-entrypoints.mdc
permissions.external.fetch or remotes assets/security-rules/forge-egress-remotes/_index-egress-remotes.mdc
SQL APIs or untrusted input reaching resolver sinks assets/security-rules/forge-injection/_index-injection.mdc
Multi-tenant patterns, module/global state, cache reuse assets/security-rules/forge-tenant-isolation/_index-tenant-isolation.mdc
Credentials/tokens/secrets handling assets/security-rules/forge-secrets-storage/_index-secrets-storage.mdc
Unsafe CSP or likely scope/config misconfiguration assets/security-rules/forge-manifest-config/_index-manifest-config.mdc
Rovo modules/actions assets/security-rules/forge-rovo-agents/_index-rovo-agents.mdc
Baseline logging/error/static analysis concerns assets/security-rules/forge-auditing/_index-auditing.mdc
Dependency/package risk review assets/security-rules/forge-misc/_index-misc.mdc

Subrule policy:

  • After reading an index, load only the subrules that match the detection heuristics observed in code.
  • Do not pre-load every subrule in a category.

Phase 3: Analysis and Verification

For each loaded category:

  1. Enumerate reachable entry points.
  2. Trace source -> validation/authz -> sink.
  3. Confirm exploitability with evidence.
  4. Score confirmed findings with CVSS v3.1.

Focused Review Mode

If the user asks for a narrow review (for example, only authz), load:

  • Global baseline
  • Requested category index
  • Only matching subrules in that category

Still mention any obvious critical findings observed outside scope.

Review Workflow

  1. Build an execution map:

- UI Kit/Custom UI entry points - Bridge invocations and resolver handlers - api.asUser() / api.asApp() call paths - External egress/remotes and trigger entry points

  1. For each finding, trace source -> validation/authz -> sink.
  2. Validate exploitability before classifying as a confirmed vulnerability.
  3. Keep non-exploitable hardening observations in a separate "needs validation" section.
  4. Provide file-level evidence and practical test leads for each issue.

Static Analysis Mode

If the user asks for a full scan, run the complete workflow from:

  • assets/security-rules/forge-auditing/static-analysis-forge.mdc

Expected tools (when available): Semgrep, npm audit, Snyk, gitleaks.

Output Requirements

  • Provide a markdown security audit report.
  • Order confirmed exploitable findings by CVSS v3.1 severity and impact.
  • Include for each confirmed finding:

- CVSS vector and base score - Severity band - Exploitability and impact - File evidence and source-to-sink trace - CWE mapping - Reproducible PoC/test steps with concrete commands

  • Include assumptions and evidence gaps.
  • Do not report scanner counts only when vulnerabilities exist.

Example Trigger Phrases

  • "Review this Forge app for security"
  • "Do a white-box security audit of my Forge app"
  • "Check this app for authz bypass and tenant isolation issues"
  • "Run full static analysis for this Forge codebase"