Fähigkeiten frame-security-scan

📦

frame-security-scan

Name: frame-security-scan
Author: lambdasec

Inhaltsrevision r1 Sicher ⚙️ Externe Befehle🌐 Netzwerkzugriff🔑 Umgebungsvariablen

Scan and Triage Code Vulnerabilities with Frame

Security scan results need source review before teams can trust findings or apply fixes. This skill guides Frame scans, evidence-based triage, patch review, and verification.

Unterstützt: Claude Codex Code(CC)

📊 75 Angemessen

Maintain this Skill? Claim it 📊 75 Angemessen

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "frame-security-scan" from https://skillstore.io/skills/lambdasec-frame-security-scan.md and its manifest at https://skillstore.io/api/skills/lambdasec-frame-security-scan/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/lambdasec-frame-security-scan.md Signiertes manifest GET /api/skills/lambdasec-frame-security-scan/manifest Signiertes lockfile GET /api/skills/lambdasec-frame-security-scan/lockfile

Testen

„frame-security-scan“ wird verwendet. Illustrative request: scan a Python service locally and triage the results.

Erwartetes Ergebnis:

Scan mode: local symbolic analysis; optional AI was not enabled.
Illustrative finding: a request value reaches a SQL execution sink without parameterization.
Triage: confirmed after reviewing attacker control and the source-to-sink path.
Next step: propose parameterized queries and review the patch before applying it.
A clean scan would not prove the service is secure.

„frame-security-scan“ wird verwendet. Illustrative request: compare an approved patch with the earlier scan.

Erwartetes Ergebnis:

Illustrative verification result: the earlier finding is no longer reported after re-scanning.
The reviewed diff replaces SQL string interpolation with parameter binding.
Project tests passed in this example; broader security coverage remains outside the scan.

Sicherheitsaudit

Sicher

v1 • 28.10.2026 Versionsbericht öffnen

All 31 static findings are false positives involving Markdown formatting, authorized tooling, a local endpoint, a repository URL, and an empty credential example. The instructions require consent for hosted AI requests, installation, and source changes. No evidence found of credential theft, unauthorized exfiltration, or prompt injection.

Gescannte Dateien

114

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Risikofaktoren

⚙️ Externe Befehle (28)

🌐 Netzwerkzugriff (2)

SKILL.md:47 SKILL.md:91

🔑 Umgebungsvariablen (1)

SKILL.md:48

Das letzte abgeschlossene statische und semantische Audit erkannte keine bestätigten Sicherheitsbefunde. Dies beweist nicht, dass der Skill keine Nebenwirkungen hat.

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/lambdasec-frame-security-scan/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/lambdasec-frame-security-scan/security.svg)](https://skillstore.io/skills/lambdasec-frame-security-scan?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/lambdasec-frame-security-scan?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/lambdasec-frame-security-scan/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/lambdasec-frame-security-scan.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

lambdasec. (2026). frame-security-scan security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/lambdasec-frame-security-scan/audits/1

BibTeX-Zitat

@techreport{lambdasec-lambdasec-frame-security-scan-2026,
  author = {lambdasec},
  title = {frame-security-scan security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/lambdasec-frame-security-scan/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "frame-security-scan security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "lambdasec"
date-released: "2026-10-28"
url: "https://skillstore.io/skills/lambdasec-frame-security-scan/audits/1"
identifiers:
  - type: other
    value: "skillstore:lambdasec-frame-security-scan:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Review Application Vulnerabilities

Scan application code and inspect reported flows before deciding which findings require fixes.

Triage Security Findings

Separate symbolic and model findings, inspect validation and reachability, and document evidence for each verdict.

Check Changed Code

Use changed-file scans, baselines, and SARIF output to support repository security checks.

Diese Prompts ausprobieren

Scan One File

Check whether Frame is installed, then scan [file] locally without AI. Summarize findings and limitations; do not install software without asking.

Triage Directory Findings

Scan [directory] without AI and save findings. Review each source-to-sink flow and explain confirmed findings, likely false positives, and unresolved questions.

Review and Verify Fixes

Triage [findings file], then propose fixes. Ask before endpoint use or source changes; show diffs, re-scan approved patches, and run project tests.

Assess Changed Code Against a Baseline

Scan files changed since [reference] using [baseline file]. Export SARIF, triage new findings, and explain verification limits without changing configuration.

Bewährte Praktiken

Start with local scanning and obtain consent before sending code to hosted endpoints.
Inspect attacker control, source-to-sink flow, validation, and reachability before assigning a triage verdict.
Review diffs, commit or back up work before approved source changes, then re-scan and run project tests.

Vermeiden

Treating low confidence or a clean scan as proof that code is safe.
Enabling hosted AI or applying source changes without explicit user agreement.
Suppressing findings or trusting model conclusions without reading the affected code.

Häufig gestellte Fragen

Does this skill install Frame automatically?

No. It checks availability and shows the installation command, but requires agreement before running installation.

Which languages support symbolic scanning?

Python, JavaScript, TypeScript, Java, C, C++, and C# have symbolic frontends. Other languages require optional LLM detection.

Does source code leave my machine?

Hosted AI endpoints receive code snippets only after consent. The documented local endpoint supports keeping AI processing on your machine.

Can the skill change source files?

It can request proposed fix diffs. In-place source changes require agreement and a commit or backup; fix generation also requires an LLM endpoint.

Can I use Frame through MCP?

Yes. A connected Frame MCP server can replace CLI commands, with the same consent rules for AI, source changes, and exploit operations.

Does a clean scan guarantee security?

No. Frame can miss vulnerabilities and report false positives. Review findings, verify fixes, and run project tests.

Entwicklerdetails

Autor

lambdasec

Lizenz

Apache-2.0

Skillstore-Revision

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/lambdasec/skills/tree/7d791206069498962a85a0f1ba95f7468dcf82f7/skills/frame-security-scan

Ref.

87c9669baf85385959f9b0a344dc9dfc8d978f9c

Aktualität der Wartung

28.10.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

📁 references/

📄 triage-checklist.md

📄 SKILL.md