security

Supply chain, secrets, and access for a repository and its agents: actions pinned by commit SHA with an owner allowlist, a vulnerability scan and an SBOM, provenance checks for skills and MCP servers, and a pre-push hook for private terms.

• Version 0.2.0
• 6 skills
• 3 gate checks
• Running on this site: Gate runs

What it does

Security for a repository and the coding agents that work in it. The skills secure what the repository's CI and agents run from outside (actions, packages, agent skills, and MCP servers), keep secrets out of tracked files and rotate the ones that got out, review who can change the repository and every merge that went past a rule, model the threats of risky changes, and turn vulnerability alerts into tickets with fix-by dates. Three gate checks run in the deploy gate of the gate module: no secret patterns in tracked files, actions only from owners on an allowlist, and no private term in tracked files, file names and built pages. The third one reads a term list that stays on the owner's machine, so it runs in a pre-push hook and in local dry runs, and returns n/a in CI.

The skills read, draft and propose. They never change repository settings, rulesets or organisation policies, never install anything without the user's go, and never print a secret value.

Install

Add the marketplace at release v0.1.0 once, then install the plugin and restart Claude Code.

claude plugin marketplace add uncovertechtalent/cto-powersuit#v0.1.0
claude plugin install security@cto-powersuit

Skills

• /security:access-review

  Read-only review of who can change a GitHub repository and how: admins, collaborators and outside collaborators, deploy keys, token lists where the caller can see them, rulesets and their bypass actors, classic branch protection, and every merge or push that went past a rule, such as a pull request merged with the admin bypass instead of the required review.

• /security:private-terms

  Keep private terms out of public repositories and pages: names of prospective employers or clients, internal shorthand, family names in business copy, private hosts and addresses.

• /security:secrets

  Keep secret values out of the repository and rotate the ones that got out: a blocking gate check for secret patterns and .env files in tracked files, a one-line scan for repositories without the gate, and a key-rotation runbook per secret that never prints the value.

• /security:supply-chain

  Secure what a repository runs that someone else wrote: actions pinned by commit SHA, an allowlist of action owners, update pull requests that keep the pins current, a vulnerability scan of the lock files, an SBOM, and a provenance check before anyone installs an agent skill or an MCP server.

• /security:threat-model

  Write a short threat model for one RFC or one risky change: assets, entry points and trust boundaries, threats by category with likelihood and impact, mitigations with owners and tickets, and the residual risk someone accepts by name.

• /security:vuln-intake

  Turn Dependabot alerts, security advisories and scan results into tickets with a fix-by date per severity: critical 7 days, high 30, medium 90, low 180 by default, from a policy page the team can change.

Gate checks

The checks this plugin adds to the deploy gate of the gate module, each with a pass fixture and a fail fixture:

• security.action-owners
• security.private-terms
• security.secrets

Source

The CTO powersuit is a set of agent skills, one module per CTO function from the deploy gate to the hand-over, that one person uses to run a company's whole engineering platform. security is one of its 18 plugins, published by Stefan Coetzee.

The skills, templates, checks, fixtures, and the full README of security at release v0.1.0: github.com/uncovertechtalent/cto-powersuit/tree/v0.1.0/plugins/security. License: MIT. Every plugin of the powersuit: CTO powersuit.