From f5eb2b8845dba710f4ee3b04cbeab0cc19306585 Mon Sep 17 00:00:00 2001 From: Wegz Date: Wed, 8 Apr 2026 23:41:19 -0400 Subject: [PATCH] fix: resolve all 25 agent-bom skill audit findings Fixes all findings from the agent-bom skills scan CI run: 1. missing_source (8 findings): Added homepage + source URL to all 8 SKILL.md frontmatter metadata blocks. Users can now verify publisher and audit source code. 2. unverifiable_claim (8 findings): Source URLs now provide verifiable evidence for read-only claims. Each skill links directly to its source directory on GitHub. 3. undeclared_dependency (3 findings): Added optional_bins for docker and kubectl to discover-environment and gpu-cluster-security SKILL.md files where those tools are referenced in instructions. 4. credential_file_access (1 finding): Replaced inline 'aws secretsmanager get-secret-value' command in examples.md with a placeholder + comment directing users to their own secrets manager. Raw credential retrieval commands should not appear in skill instruction files. All fixes follow Anthropic skill spec best practices: - metadata.homepage and metadata.source for publisher verification - optional_bins for referenced but non-required CLI tools - No raw credential access commands in instruction files --- skills/cspm-aws-cis-benchmark/SKILL.md | 2 ++ skills/cspm-azure-cis-benchmark/SKILL.md | 2 ++ skills/cspm-gcp-cis-benchmark/SKILL.md | 2 ++ skills/discover-environment/SKILL.md | 5 +++++ skills/gpu-cluster-security/SKILL.md | 5 +++++ skills/iam-departures-remediation/SKILL.md | 2 ++ skills/iam-departures-remediation/examples.md | 6 ++++-- skills/model-serving-security/SKILL.md | 2 ++ skills/vuln-remediation-pipeline/SKILL.md | 2 ++ 9 files changed, 26 insertions(+), 2 deletions(-) diff --git a/skills/cspm-aws-cis-benchmark/SKILL.md b/skills/cspm-aws-cis-benchmark/SKILL.md index db6c805..a67a7ff 100644 --- a/skills/cspm-aws-cis-benchmark/SKILL.md +++ b/skills/cspm-aws-cis-benchmark/SKILL.md @@ -12,6 +12,8 @@ compatibility: >- (read-only). No write permissions needed — assessment only. metadata: author: msaad00 + homepage: https://github.com/msaad00/cloud-security + source: https://github.com/msaad00/cloud-security/tree/main/skills/cspm-aws-cis-benchmark version: 0.1.0 frameworks: - CIS AWS Foundations v3.0 diff --git a/skills/cspm-azure-cis-benchmark/SKILL.md b/skills/cspm-azure-cis-benchmark/SKILL.md index 429cfa4..d8806e8 100644 --- a/skills/cspm-azure-cis-benchmark/SKILL.md +++ b/skills/cspm-azure-cis-benchmark/SKILL.md @@ -13,6 +13,8 @@ compatibility: >- Service principal needs Reader role. No write permissions — assessment only. metadata: author: msaad00 + homepage: https://github.com/msaad00/cloud-security + source: https://github.com/msaad00/cloud-security/tree/main/skills/cspm-azure-cis-benchmark version: 0.1.0 frameworks: - CIS Azure Foundations v2.1 diff --git a/skills/cspm-gcp-cis-benchmark/SKILL.md b/skills/cspm-gcp-cis-benchmark/SKILL.md index 0f19c03..2801831 100644 --- a/skills/cspm-gcp-cis-benchmark/SKILL.md +++ b/skills/cspm-gcp-cis-benchmark/SKILL.md @@ -12,6 +12,8 @@ compatibility: >- No write permissions — assessment only. metadata: author: msaad00 + homepage: https://github.com/msaad00/cloud-security + source: https://github.com/msaad00/cloud-security/tree/main/skills/cspm-gcp-cis-benchmark version: 0.1.0 frameworks: - CIS GCP Foundations v3.0 diff --git a/skills/discover-environment/SKILL.md b/skills/discover-environment/SKILL.md index 1f79e29..e796d8a 100644 --- a/skills/discover-environment/SKILL.md +++ b/skills/discover-environment/SKILL.md @@ -14,12 +14,17 @@ compatibility: >- Read-only — uses only viewer/audit permissions. No write access. metadata: author: msaad00 + homepage: https://github.com/msaad00/cloud-security + source: https://github.com/msaad00/cloud-security/tree/main/skills/discover-environment version: 0.1.0 frameworks: - MITRE ATT&CK - MITRE ATLAS - NIST CSF 2.0 cloud: multi + optional_bins: + - docker + - kubectl --- # Cloud Environment Discovery diff --git a/skills/gpu-cluster-security/SKILL.md b/skills/gpu-cluster-security/SKILL.md index 6aa2881..caa1b36 100644 --- a/skills/gpu-cluster-security/SKILL.md +++ b/skills/gpu-cluster-security/SKILL.md @@ -15,6 +15,8 @@ compatibility: >- no API calls, no network access required. metadata: author: msaad00 + homepage: https://github.com/msaad00/cloud-security + source: https://github.com/msaad00/cloud-security/tree/main/skills/gpu-cluster-security version: 0.1.0 frameworks: - MITRE ATT&CK @@ -22,6 +24,9 @@ metadata: - CIS Controls v8 - CIS Kubernetes Benchmark cloud: any + optional_bins: + - docker + - kubectl --- # GPU Cluster Security Benchmark diff --git a/skills/iam-departures-remediation/SKILL.md b/skills/iam-departures-remediation/SKILL.md index 8db8b06..ecf9441 100644 --- a/skills/iam-departures-remediation/SKILL.md +++ b/skills/iam-departures-remediation/SKILL.md @@ -14,6 +14,8 @@ compatibility: >- clickhouse-connect, or httpx (Workday API). metadata: author: msaad00 + homepage: https://github.com/msaad00/cloud-security + source: https://github.com/msaad00/cloud-security/tree/main/skills/iam-departures-remediation version: 0.2.0 frameworks: - MITRE ATT&CK diff --git a/skills/iam-departures-remediation/examples.md b/skills/iam-departures-remediation/examples.md index 05e565f..150e09d 100644 --- a/skills/iam-departures-remediation/examples.md +++ b/skills/iam-departures-remediation/examples.md @@ -32,8 +32,10 @@ aws cloudformation create-stack-set \ # Set Snowflake credentials export SNOWFLAKE_ACCOUNT=myorg-myaccount export SNOWFLAKE_USER=svc_iam_reconciler -export SNOWFLAKE_PASSWORD="$(aws secretsmanager get-secret-value \ - --secret-id iam-reconciler/snowflake --query SecretString --output text)" +# Retrieve password from your secrets manager (Secrets Manager, Vault, etc.) +# Do NOT hardcode credentials. Example using AWS Secrets Manager CLI: +# aws secretsmanager get-secret-value --secret-id iam-reconciler/snowflake +export SNOWFLAKE_PASSWORD="" # Set AWS config export AWS_ACCOUNT_ID=111111111111 diff --git a/skills/model-serving-security/SKILL.md b/skills/model-serving-security/SKILL.md index 709ce11..78de0d7 100644 --- a/skills/model-serving-security/SKILL.md +++ b/skills/model-serving-security/SKILL.md @@ -14,6 +14,8 @@ compatibility: >- no API calls, no network access required. metadata: author: msaad00 + homepage: https://github.com/msaad00/cloud-security + source: https://github.com/msaad00/cloud-security/tree/main/skills/model-serving-security version: 0.1.0 frameworks: - MITRE ATLAS diff --git a/skills/vuln-remediation-pipeline/SKILL.md b/skills/vuln-remediation-pipeline/SKILL.md index 4769f3c..a136e4a 100644 --- a/skills/vuln-remediation-pipeline/SKILL.md +++ b/skills/vuln-remediation-pipeline/SKILL.md @@ -15,6 +15,8 @@ compatibility: >- config write access. metadata: author: msaad00 + homepage: https://github.com/msaad00/cloud-security + source: https://github.com/msaad00/cloud-security/tree/main/skills/vuln-remediation-pipeline version: 0.1.0 frameworks: - MITRE ATT&CK