# forge-security-review

> Claude/Codex skill by [@atlassian](https://omgskills.com/library/atlassian/index.md) · 27 stars · Updated 2026-10-20

Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web trigger hardening, or static analysis execution for a Forge app.

Tags: agent-skills, ai-agents, claude-code-plugin, claude-code-skills, gemini-cli-extension, mcp

## Install

```sh
git clone https://github.com/atlassian/forge-skills /tmp/forge-skills && ln -s /tmp/forge-skills/skills/forge-security-review ~/.claude/skills/forge-security-review
```

## From README

Forge Security Review Runs a Forge-focused white-box security review and reports validated findings with exploitability, impact, evidence, and remediation guidance. Token-Efficient Default Use manifest-driven routing by default to reduce token . Do not load every rule file up front. Rule Assets The review rules are packaged with this skill under assets/security-rules/: Global baseline: assets/security-rules/global-forge.mdc Category indexes: assets/security-rules/forge-/index-.mdc Category deep checks: assets/security-rules/forge-/.mdc Execution Mandate When this skill is triggered: Run static analysis first from this skill directory: scripts/runstaticanalysis.sh use .ps1 script for windows Read manifest.yml first before any deep code review. Load assets/security-rules/global-forge.mdc first. Load only relevant category index rules based on manifest and code signals. Load deep subrules only when the matching detection heuristics are triggered by real code patterns.

## Links

- HTML page: https://omgskills.com/library/atlassian/forge-skills/skills/forge-security-review/
- GitHub: https://github.com/atlassian/forge-skills
- Author: [@atlassian](https://omgskills.com/library/atlassian/index.md)

## More from this repo

- [forge-app-builder](https://omgskills.com/library/atlassian/forge-skills/skills/forge-app-builder/index.md) — Plan, build, scaffold, or safely extend Atlassian Forge apps using current official documentation.
   - [@atlassian](https://omgskills.com/library/atlassian/index.md) · 27 stars
- [forge-app-review](https://omgskills.com/library/atlassian/forge-skills/skills/forge-app-review/index.md) — Performs a lightweight pre-release readiness review of Atlassian Forge apps across manifest/module wiring,...
   - [@atlassian](https://omgskills.com/library/atlassian/index.md) · 27 stars
- [forge-cost-optimizer](https://omgskills.com/library/atlassian/forge-skills/skills/forge-cost-optimizer/index.md) — Optimizes Atlassian Forge apps to reduce platform consumption and avoid unnecessary costs using Atlassian's "Optimise...
   - [@atlassian](https://omgskills.com/library/atlassian/index.md) · 27 stars