forge-security-review
Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web trigger hardening, or static analysis execution for a Forge app.
Install
With your agent
Install OMGSkills skill "atlassian/forge-skills:skills/forge-security-review" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/atlassian/forge-skills /tmp/forge-skills && ln -s /tmp/forge-skills/skills/forge-security-review ~/.claude/skills/forge-security-reviewFrom README
Forge Security Review Runs a Forge-focused white-box security review and reports validated findings with exploitability, impact, evidence, and remediation guidance. Token-Efficient Default Use manifest-driven routing by default to reduce token . Do not load every rule file up front. Rule Assets The review rules are packaged with this skill under assets/security-rules/: Global baseline: assets/security-rules/global-forge.mdc Category indexes: assets/security-rules/forge-/index-.mdc Category deep checks: assets/security-rules/forge-/.mdc Execution Mandate When this skill is triggered: Run static analysis first from this skill directory: scripts/runstaticanalysis.sh use .ps1 script for windows Read manifest.yml first before any deep code review. Load assets/security-rules/global-forge.mdc first. Load only relevant category index rules based on manifest and code signals. Load deep subrules only when the matching detection heuristics are triggered by real code patterns.
More from this repo
forge-app-builder
Plan, build, scaffold, or safely extend Atlassian Forge apps using current official documentation.
forge-app-review
Performs a lightweight pre-release readiness review of Atlassian Forge apps across manifest/module wiring,...
forge-cost-optimizer
Optimizes Atlassian Forge apps to reduce platform consumption and avoid unnecessary costs using Atlassian's "Optimise...