V3 Security Overhaul

ruvnet/ruflo/v3/@claude-flow/cli/.claude/skills/v3-security-overhaul

作者 ruvnet58e0ae7e14e68aab45a4127d6f42f567bbcfb328无许可证74K 个星标收录于 2026年10月9日更新于 2026年10月9日仓库昨天更新

Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for security-first v3 implementation.

仅含说明Security

AI 生成的概览

为 claude-flow v3 统筹安全改造，修复关键 CVE 并落实默认安全模式。

功能: 该技能通过调度专门的安全代理，为 claude-flow v3 统筹安全架构改造，包括设计威胁模型、修复关键 CVE 以及构建安全测试。它记录了针对易受攻击依赖、弱密码哈希和硬编码凭据的修复方法，并给出安全编码模式，例如 Zod 输入校验、路径净化和不使用 shell 的命令执行。它还定义了成功指标，涵盖安全评分、CVE 解决率、测试覆盖率以及已记录并测试的实现。它产出的是指导与修复说明，而非可执行脚本。
适用场景: 适用于对 claude-flow v3 进行安全优先的实现或改造。适合需要处理所列关键 CVE 并采用默认安全开发实践的工作。也适合为该代码库建立威胁模型、安全边界和安全测试覆盖。
运行要求: 需要能够调度专门子代理或任务的代理环境；依赖更新与审计命令需要 Node.js 和 npm；所示模式需要 bcrypt 与 zod 包。该技能不附带脚本。

V3 Security Overhaul

What This Skill Does

Orchestrates comprehensive security overhaul for claude-flow v3, addressing critical vulnerabilities and establishing security-first development practices using specialized v3 security agents.

Quick Start

bash

# Initialize V3 security domain (parallel)Task("Security architecture", "Design v3 threat model and security boundaries", "v3-security-architect")Task("CVE remediation", "Fix CVE-1, CVE-2, CVE-3 critical vulnerabilities", "security-auditor")Task("Security testing", "Implement TDD London School security framework", "test-architect")

# Initialize V3 security domain (parallel)Task("Security architecture", "Design v3 threat model and security boundaries", "v3-security-architect")Task("CVE remediation", "Fix CVE-1, CVE-2, CVE-3 critical vulnerabilities", "security-auditor")Task("Security testing", "Implement TDD London School security framework", "test-architect")

Critical Security Fixes

CVE-1: Vulnerable Dependencies

CVE-2: Weak Password Hashing

typescript

// ❌ Old: SHA-256 with hardcoded saltconst hash = crypto.createHash('sha256').update(password + salt).digest('hex');
// ✅ New: bcrypt with 12 roundsimport bcrypt from 'bcrypt';const hash = await bcrypt.hash(password, 12);

// ❌ Old: SHA-256 with hardcoded saltconst hash = crypto.createHash('sha256').update(password + salt).digest('hex');
// ✅ New: bcrypt with 12 roundsimport bcrypt from 'bcrypt';const hash = await bcrypt.hash(password, 12);

CVE-3: Hardcoded Credentials

typescript

// ✅ Generate secure random credentialsconst apiKey = crypto.randomBytes(32).toString('hex');

// ✅ Generate secure random credentialsconst apiKey = crypto.randomBytes(32).toString('hex');

Security Patterns

Input Validation (Zod)

typescript

import { z } from 'zod';
const TaskSchema = z.object({  taskId: z.string().uuid(),  content: z.string().max(10000),  agentType: z.enum(['security', 'core', 'integration'])});

import { z } from 'zod';
const TaskSchema = z.object({  taskId: z.string().uuid(),  content: z.string().max(10000),  agentType: z.enum(['security', 'core', 'integration'])});

Path Sanitization

typescript

function securePath(userPath: string, allowedPrefix: string): string {  const resolved = path.resolve(allowedPrefix, userPath);  if (!resolved.startsWith(path.resolve(allowedPrefix))) {    throw new SecurityError('Path traversal detected');  }  return resolved;}

function securePath(userPath: string, allowedPrefix: string): string {  const resolved = path.resolve(allowedPrefix, userPath);  if (!resolved.startsWith(path.resolve(allowedPrefix))) {    throw new SecurityError('Path traversal detected');  }  return resolved;}

Safe Command Execution

typescript

import { execFile } from 'child_process';
// ✅ Safe: No shell interpretationconst { stdout } = await execFile('git', [userInput], { shell: false });

import { execFile } from 'child_process';
// ✅ Safe: No shell interpretationconst { stdout } = await execFile('git', [userInput], { shell: false });

Success Metrics

Security Score: 90/100 (npm audit + custom scans)
CVE Resolution: 100% of critical vulnerabilities fixed
Test Coverage: >95% security-critical code
Implementation: All secure patterns documented and tested

来源与署名

来源：ruvnet/ruflo位于v3/@claude-flow/cli/.claude/skills/v3-security-overhaul提交58e0ae7

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

V3 Security Overhaul

V3 Security Overhaul

What This Skill Does

Quick Start

Critical Security Fixes

CVE-1: Vulnerable Dependencies

CVE-2: Weak Password Hashing

CVE-3: Hardcoded Credentials

Security Patterns

Input Validation (Zod)

Path Sanitization

Safe Command Execution

Success Metrics

来源与署名

更多来自 ruvnet/ruflo 的技能

V3 Swarm Coordination

V3 Memory Unification

V3 Performance Optimization

V3 MCP Optimization

V3 DDD Architecture

V3 Core Implementation

更多Security技能

Memory Leak Audit

Kyc Rules

Kyc Rules

Compliance Tracking

Sign In With Google Web

Google Cloud Scc Remediation