.claude/skills/command-security-design/SKILL.md

コマンドのセキュリティ設計を専門とするスキル。 allowed-toolsによるツール制限、disable-model-invocationによる自動実行防止、機密情報保護の実装方法を提供します。 📖 参照書籍: - 『Web Application Security』（Andrew Hoffman）: 脅威モデリング 📚 リソース参照: - `resources/Level1_basics.md`: レベル1の基礎ガイド - `resources/Level2_intermediate.md`: レベル2の実務ガイド - `resources/Level3_advanced....

mattnigh/skills_collection·0installs24starsSecurity

SKILL.md

Full skill instructions

Command Security Design

概要

コマンドのセキュリティ設計を専門とするスキル。 allowed-toolsによるツール制限、disable-model-invocationによる自動実行防止、機密情報保護の実装方法を提供します。

詳細な手順や背景は resources/Level1_basics.md と resources/Level2_intermediate.md を参照してください。

ワークフロー

Phase 1: 目的と前提の整理

目的: タスクの目的と前提条件を明確にする

アクション:

resources/Level1_basics.md と resources/Level2_intermediate.md を確認
必要な resources/scripts/templates を特定

Phase 2: スキル適用

目的: スキルの指針に従って具体的な作業を進める

アクション:

関連リソースやテンプレートを参照しながら作業を実施
重要な判断点をメモとして残す

Phase 3: 検証と記録

目的: 成果物の検証と実行記録の保存

アクション:

scripts/validate-skill.mjs でスキル構造を確認
成果物が目的に合致するか確認
scripts/log_usage.mjs を実行して記録を残す

ベストプラクティス

すべきこと

破壊的な操作を行うコマンドを作成する時
ツール使用を制限したい時
機密情報の誤コミットを防ぐチェックを実装する時

避けるべきこと

アンチパターンや注意点を確認せずに進めることを避ける

コマンドリファレンス

リソース読み取り

cat .claude/skills/command-security-design/resources/Level1_basics.md
cat .claude/skills/command-security-design/resources/Level2_intermediate.md
cat .claude/skills/command-security-design/resources/Level3_advanced.md
cat .claude/skills/command-security-design/resources/Level4_expert.md
cat .claude/skills/command-security-design/resources/legacy-skill.md
cat .claude/skills/command-security-design/resources/security-guidelines.md

スクリプト実行

node .claude/skills/command-security-design/scripts/audit-security.mjs --help
node .claude/skills/command-security-design/scripts/log_usage.mjs --help
node .claude/skills/command-security-design/scripts/validate-skill.mjs --help

テンプレート参照

cat .claude/skills/command-security-design/templates/secure-command.md

変更履歴

Version	Date	Changes
1.0.0	2025-12-24	Spec alignment and required artifacts added

Install skill

Copy and run in your terminal

npx -y skills add https://github.com/mattnigh/skills_collection --skill daishiman__AIWorkflowOrchestrator__claude__skills__command-security-design__SKILL.md

View on GitHub

collection/daishiman__AIWorkflowOrchestrator__claude__skills__command-security-design__SKILL.md

More Security skills

View all

Security

supabase

Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...

2.7K 308.9K

View

Security

neon-postgres

Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.

98 216.2K

View

Security

firebase-auth-basics

Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

462 163.8K

View

Security

firebase-security-rules-auditor

A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.

462 127.7K

View

Security

firebase-ai-logic-basics

Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.

462 125.1K

View

Security

better-auth-best-practices

Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.

222 118.2K

View

Security

vercel-cli-with-tokens

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

31.9K 116.1K

View

Security

cloudflare

Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.

3K 110.7K

View

Security

azure-compliance

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

253 103K

View