From qe-framework
Conducts security audits, SAST scans, penetration tests, and compliance checks. Generates structured vulnerability reports with severity ratings and remediation guidance.
How this skill is triggered — by the user, by Claude, or both
Slash command
/qe-framework:Qsecurity-reviewerThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security.
Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security.
semgrep --config=auto .bandit -r ./srcgitleaks detect --source=.npm audit --audit-level=moderatetrivy fs .Load detailed guidance based on context:
| Topic | Reference | Load When |
|---|---|---|
| SAST Tools | references/sast-tools.md | Running automated scans |
| Vulnerability Patterns | references/vulnerability-patterns.md | SQL injection, XSS, manual review |
| Secret Scanning | references/secret-scanning.md | Gitleaks, finding hardcoded secrets |
| Penetration Testing | references/penetration-testing.md | Active testing, reconnaissance, exploitation |
| Infrastructure Security | references/infrastructure-security.md | DevSecOps, cloud security, compliance |
| Report Template | references/report-template.md | Writing security report |
ID: FIND-001
Severity: High (CVSS 8.1)
Title: SQL Injection in user search endpoint
File: src/api/users.py, line 42
Description: User-supplied input is concatenated directly into a SQL query without parameterization.
Impact: An attacker can read, modify, or delete database contents.
Remediation: Use parameterized queries or an ORM. Replace `cursor.execute(f"SELECT * FROM users WHERE name='{name}'")`
with `cursor.execute("SELECT * FROM users WHERE name=%s", (name,))`.
References: CWE-89, OWASP A03:2021
# Example: Semgrep finding with severity and remediation
semgrep --config=auto --json src/ | jq '.results[] | {path: .path, line: .start.line, rule: .check_id, message: .extra.message}'
# Output structure (JSON):
{
"path": "src/auth.js",
"line": 42,
"rule": "sql-injection",
"message": "User input concatenated into SQL query"
}
# Audit with detailed output
npm audit --json | jq '.vulnerabilities[] | {package: .name, severity: .severity, cve: .via[0].cve}'
# Output:
{
"package": "lodash",
"severity": "high",
"cve": "CVE-2021-23337"
}
# Detect hardcoded secrets (API keys, tokens, passwords)
gitleaks detect --source=. --report-path=findings.json
# Remediation: Rotate exposed credentials immediately, move to .env
export DB_PASSWORD=$(aws secretsmanager get-secret-value --secret-id prod/db-password)
Security findings should follow CVSS + remediation format:
**ID:** FIND-[###]
**Severity:** CRITICAL (CVSS 9.8) | HIGH | MEDIUM | LOW | INFO
**Title:** [Vulnerability title]
**CWE:** CWE-###, OWASP A##:####
**File:** path/to/file.ts, lines 42-50
**Description:** [What is vulnerable and why]
**Proof of Concept:**
[Minimal exploit demonstrating the issue]
**Impact:** [Business/technical impact]
**Remediation:**
1. [Fix #1 with code example]
2. [Fix #2 alternative]
**References:** [Links to OWASP, CWE, patch notes]
Automate security scanning in CI:
# SAST scanning
semgrep --config=auto --error .
# Dependency auditing
npm audit --audit-level=moderate
# Secrets detection
gitleaks detect --verbose --exit-code 1
# Infrastructure scanning
trivy fs . --exit-code 1 --severity HIGH,CRITICAL
# Container images
trivy image --severity CRITICAL,HIGH myregistry.azurecr.io/app:latest
| Anti-Pattern | Wrong | Correct |
|---|---|---|
| False Positive Overload | Report every tool finding without verification | Manually verify SAST results; log false positives in config to suppress |
| No Severity Ranking | List 50 findings in random order | Prioritize CRITICAL/HIGH first; group by CWE/OWASP category |
| Manual-Only Scanning | Run semgrep once, never again | Integrate SAST into CI/CD; run on every commit |
| Ignoring Dependencies | Only audit code, skip node_modules/ | Run npm audit + trivy fs in every pipeline |
| No Remediation Guidance | "This is vulnerable" (no fix provided) | Include specific code examples and tool commands to fix each issue |
OWASP Top 10, CWE, Semgrep, Bandit, ESLint Security, gosec, npm audit, gitleaks, trufflehog, CVSS scoring, nmap, Burp Suite, sqlmap, Trivy, Checkov, HashiCorp Vault, AWS Security Hub, CIS benchmarks, SOC2, ISO27001
npx claudepluginhub inho-team/qe-framework --plugin qe-frameworkCreates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.