How do I install the Ktnyt Cclsp Cclsp skill?

Run npx skillmds@latest add tomevault-io/ktnyt-cclsp-cclsp in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Ktnyt Cclsp Cclsp skill do?

Security Review It is listed under Security on SkillMD.

Is Ktnyt Cclsp Cclsp safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ktnyt Cclsp Cclsp?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ktnyt Cclsp Cclsp free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ktnyt Cclsp Cclsp?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ktnyt Cclsp Cclsp by tomevault-io — Agent Skill

Name: Ktnyt Cclsp Cclsp
Author: tomevault-io

File contents

Security Review

Invoke the security-reviewer agent to assess security-sensitive changes.

When to trigger

Child process spawning or lifecycle changes (src/lsp-client.ts)
File system read/write operations (src/file-editor.ts, src/file-scanner.ts)
Configuration file loading or parsing (cclsp.json, CCLSP_CONFIG_PATH)
Environment variable handling
New or modified LSP server adapter (src/lsp/adapters/)
Setup wizard input handling (src/setup.ts)

Review checklist

Command injection: Are user-supplied values (config file paths, server commands) sanitized before being passed to child_process spawn?
Path traversal: Can file paths from LSP responses escape the project root? Are file:// URIs validated before resolving?
Resource exhaustion: Are there timeouts on LSP server responses? Can a malicious LSP server cause unbounded memory growth?
Config trust boundary: Is cclsp.json treated as trusted input? What happens if it contains unexpected fields or types?
Process cleanup: Are child processes reliably terminated on shutdown? Can orphaned processes persist?
Symlink attacks: Does file resolution follow symlinks outside the project directory?

How to invoke

Use the everything-claude-code:security-reviewer agent via the Task tool:

Task(
  subagent_type: "everything-claude-code:security-reviewer",
  prompt: "Review the following changes for security concerns: <describe changes>"
)

Output expectations

The security reviewer should produce:

CRITICAL: Must fix before merge (injection, traversal, credential leak)
HIGH: Should fix before merge (missing timeouts, incomplete cleanup)
MEDIUM: Fix when possible (defensive checks, hardening opportunities)
LOW: Informational (best practice suggestions)

Source: ktnyt/cclsp — distributed by TomeVault.

---name: ktnyt-cclsp-cclspdescription: Security Review---# Security ReviewInvoke the security-reviewer agent to assess security-sensitive changes.## When to trigger- Child process spawning or lifecycle changes (`src/lsp-client.ts`)- File system read/write operations (`src/file-editor.ts`, `src/file-scanner.ts`)- Configuration file loading or parsing (`cclsp.json`, `CCLSP_CONFIG_PATH`)- Environment variable handling- New or modified LSP server adapter (`src/lsp/adapters/`)- Setup wizard input handling (`src/setup.ts`)## Review checklist1. **Command injection**: Are user-supplied values (config file paths, server commands) sanitized before being passed to `child_process` spawn?2. **Path traversal**: Can file paths from LSP responses escape the project root? Are `file://` URIs validated before resolving?3. **Resource exhaustion**: Are there timeouts on LSP server responses? Can a malicious LSP server cause unbounded memory growth?4. **Config trust boundary**: Is `cclsp.json` treated as trusted input? What happens if it contains unexpected fields or types?5. **Process cleanup**: Are child processes reliably terminated on shutdown? Can orphaned processes persist?6. **Symlink attacks**: Does file resolution follow symlinks outside the project directory?## How to invokeUse the `everything-claude-code:security-reviewer` agent via the Task tool:```Task( subagent_type: "everything-claude-code:security-reviewer", prompt: "Review the following changes for security concerns: <describe changes>")```## Output expectationsThe security reviewer should produce:- **CRITICAL**: Must fix before merge (injection, traversal, credential leak)- **HIGH**: Should fix before merge (missing timeouts, incomplete cleanup)- **MEDIUM**: Fix when possible (defensive checks, hardening opportunities)- **LOW**: Informational (best practice suggestions)---> Source: [ktnyt/cclsp](https://github.com/ktnyt/cclsp) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions

Ktnyt Cclsp Cclsp