# Pop Assessment Security

> Validates PopKit security posture using concrete vulnerability patterns, automated secret scanning, and OWASP-aligned checklists

- Skill: `majiayu000/pop-assessment-security` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/pop-assessment-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/pop-assessment-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/pop-assessment-security

---


# Security Assessment Skill

## Purpose

Provides concrete, reproducible security assessment for PopKit plugins using:
- Machine-readable vulnerability patterns
- Automated secret and injection scanning
- OWASP-aligned security checklists
- Deterministic scoring

## How to Use

### Step 1: Run Automated Security Scan

```bash
python skills/pop-assessment-security/scripts/scan_secrets.py packages/plugin/
python skills/pop-assessment-security/scripts/scan_injection.py packages/plugin/
python skills/pop-assessment-security/scripts/calculate_risk.py packages/plugin/
```

### Step 2: Apply Security Checklists

Read and apply checklists in order:
1. `checklists/secret-detection.json` - Hardcoded credentials
2. `checklists/injection-patterns.json` - Command/path injection
3. `checklists/owasp-alignment.json` - OWASP Top 10 mapping

### Step 3: Generate Report

Combine automated findings with checklist results for final security report.

## Standards Reference

| Standard | File | Key Checks |
|----------|------|------------|
| Secret Detection | `standards/secret-patterns.md` | SD-001 through SD-010 |
| Injection Prevention | `standards/injection-prevention.md` | IP-001 through IP-008 |
| Access Control | `standards/access-control.md` | AC-001 through AC-006 |
| Input Validation | `standards/input-validation.md` | IV-001 through IV-008 |

## Severity Classification

| Level | Score | Description | Action |
|-------|-------|-------------|--------|
| Critical | 9-10 | Immediately exploitable | Block release |
| High | 7-8 | Likely exploitable | Must fix |
| Medium | 4-6 | Conditionally exploitable | Should fix |
| Low | 1-3 | Minor risk | Consider fixing |
| Info | 0 | Best practice | Optional |

## Output

Returns JSON with:
- `risk_score`: 0-100 (higher = more risk)
- `vulnerabilities`: List with severity, location, CWE
- `passed_checks`: Security controls that passed
- `recommendations`: Prioritized fix list