← All skills
forge-security-review
92 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By atlassian/forge-skills (GitHub) · coding · 30 stars · scanned at commit ed1b87e
Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web trigger hardening, or static analysis execution for a Forge app.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: ${host}${path}
This is disclosed by the author in the skill's SKILL.md or README.
Found in 45 places.
Show 17 more
- skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 203
- pattern: api.fetch($URL, ...) - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 204
- pattern: api.asApp().fetch($URL, ...) - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 205
- pattern: api.asUser().fetch($URL, ...) - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 206
- pattern: $API.asApp().fetch($URL, ...) - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 207
- pattern: $API.asUser().fetch($URL, ...) - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 759
- pattern: api.fetch(...) - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 760
- pattern: $A.fetch(...) - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 761
- pattern: fetch(...) - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 2506
- pattern: "if (<... $REPLY ...>) { ... $API.fetch($U, { ..., method: $MM, ... }); ... }" - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 2507
- pattern: "if (<... $REPLY ...>) { ... fetch($U, { ..., method: $MM, ... }); ... }" - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 2525
The manifest allows backend or client fetch (or script loading) from any host ("*"). The - skills/forge-security-review/assets/security-rules/forge-injection/ssrf.mdc, line 18
- User input in `fetch()` URLs. - skills/forge-security-review/assets/security-rules/forge-injection/ssrf.mdc, line 32
await fetch(webhookUrl); // SSRF to internal services - skills/forge-security-review/assets/security-rules/forge-injection/ssrf.mdc, line 41
const response = await fetch(imageUrl); // Could be internal URL - skills/forge-security-review/assets/security-rules/forge-injection/ssrf.mdc, line 46
await fetch(`https://${host}${path}`); // Host/path injection - skills/forge-security-review/assets/security-rules/forge-injection/ssrf.mdc, line 81
await fetch(webhookUrl); - skills/forge-security-review/assets/security-rules/forge-injection/ssrf.mdc, line 99
- [ ] Find `fetch()` calls with dynamic URLs.
and 25 more places
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 21 places.
Show 17 more
- skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 655
- pattern: import 'child_process' - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 656
- pattern: import 'node:child_process' - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 657
- pattern: import $X from 'child_process' - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 658
- pattern: import $X from 'node:child_process' - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 659
- pattern: import * as $X from 'child_process' - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 660
- pattern: import * as $X from 'node:child_process' - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 661
- pattern: "import { $X } from 'child_process'" - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 662
- pattern: "import { $X } from 'node:child_process'" - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 663
- pattern: import('child_process') - skills/forge-security-review/assets/opengrep-rules/forge-security-rules.yaml, line 664
- pattern: import('node:child_process') - skills/forge-security-review/assets/security-rules/forge-auditing/static-analysis-forge.mdc, line 78
| RCE / sandbox | `eval`, `new Function`, `child_process`, `fs` in backend code | OpenGrep `forge-sandbox-no-*` | - skills/forge-security-review/assets/security-rules/forge-injection/rce-code-execution.mdc, line 25
- `child_process.exec(command)` - skills/forge-security-review/assets/security-rules/forge-injection/rce-code-execution.mdc, line 26
- `child_process.spawn(cmd, args)` - skills/forge-security-review/assets/security-rules/forge-injection/rce-code-execution.mdc, line 155
- `forge-sandbox-no-child-process` (ERROR) and `forge-sandbox-no-filesystem` (WARNING): `child_process` and `fs` imports (including `node:` specifiers) in backe - skills/forge-security-review/evals/fixtures/core/vulnerable/src/index.js, line 5
const { exec } = require('child_process'); // forge-sandbox-no-child-process - skills/forge-security-review/tests/test_static_analysis.py, line 117
subprocess.run([bash, "-n", str(SH_SCRIPT)], check=True) - skills/forge-security-review/tests/test_static_analysis.py, line 188
proc = subprocess.run(["bash", str(SH_SCRIPT), str(fixture_dir)], env=env, capture_output=True, text=True)
and 1 more places
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'forge-security-review' ] || [ -L ~/.agents/skills/'forge-security-review' ]; then echo 'A skill folder named forge-security-review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/atlassian/forge-skills' "$d" && git -C "$d" checkout --quiet 'ed1b87e1356392b3489f79ad648fac16ae06be5e' -- 'skills/forge-security-review' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/forge-security-review' ~/.agents/skills/'forge-security-review' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'forge-security-review' ~/.claude/skills/'forge-security-review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for atlassian/forge-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/atlassian/forge-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | ed1b87e | 92 |
| 2026-11-08 | ccef03b | 75 |
| 2026-11-06 | ccef03b | 65 |