From c0c58d89722b6c17832428612628db7d6d96810b Mon Sep 17 00:00:00 2001 From: Zhongwei Li Date: Sun, 30 Nov 2025 08:22:37 +0800 Subject: [PATCH] Initial commit --- .claude-plugin/plugin.json | 15 +++++ README.md | 3 + commands/check-session.md | 8 +++ plugin.lock.json | 61 +++++++++++++++++++ skills/session-security-checker/SKILL.md | 53 ++++++++++++++++ .../session-security-checker/assets/README.md | 6 ++ .../references/README.md | 7 +++ .../scripts/README.md | 6 ++ 8 files changed, 159 insertions(+) create mode 100644 .claude-plugin/plugin.json create mode 100644 README.md create mode 100644 commands/check-session.md create mode 100644 plugin.lock.json create mode 100644 skills/session-security-checker/SKILL.md create mode 100644 skills/session-security-checker/assets/README.md create mode 100644 skills/session-security-checker/references/README.md create mode 100644 skills/session-security-checker/scripts/README.md diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json new file mode 100644 index 0000000..79675ee --- /dev/null +++ b/.claude-plugin/plugin.json @@ -0,0 +1,15 @@ +{ + "name": "session-security-checker", + "description": "Check session security implementation", + "version": "1.0.0", + "author": { + "name": "Jeremy Longshore", + "email": "[email protected]" + }, + "skills": [ + "./skills" + ], + "commands": [ + "./commands" + ] +} \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..ccf8bd9 --- /dev/null +++ b/README.md @@ -0,0 +1,3 @@ +# session-security-checker + +Check session security implementation diff --git a/commands/check-session.md b/commands/check-session.md new file mode 100644 index 0000000..205880e --- /dev/null +++ b/commands/check-session.md @@ -0,0 +1,8 @@ +--- +description: DESCRIPTION_PLACEHOLDER +shortcut: SHORTCUT_PLACEHOLDER +--- + +# TITLE_PLACEHOLDER + +CONTENT_PLACEHOLDER diff --git a/plugin.lock.json b/plugin.lock.json new file mode 100644 index 0000000..6e059c7 --- /dev/null +++ b/plugin.lock.json @@ -0,0 +1,61 @@ +{ + "$schema": "internal://schemas/plugin.lock.v1.json", + "pluginId": "gh:jeremylongshore/claude-code-plugins-plus:plugins/security/session-security-checker", + "normalized": { + "repo": null, + "ref": "refs/tags/v20251128.0", + "commit": "053bf14d49871503c5b6b54298dc797d24821d53", + "treeHash": "80dca2af1d1f29f22d237e2999100add002583c00e909a3f756699de69b40345", + "generatedAt": "2025-11-28T10:18:45.428865Z", + "toolVersion": "publish_plugins.py@0.2.0" + }, + "origin": { + "remote": "git@github.com:zhongweili/42plugin-data.git", + "branch": "master", + "commit": "aa1497ed0949fd50e99e70d6324a29c5b34f9390", + "repoRoot": "/Users/zhongweili/projects/openmind/42plugin-data" + }, + "manifest": { + "name": "session-security-checker", + "description": "Check session security implementation", + "version": "1.0.0" + }, + "content": { + "files": [ + { + "path": "README.md", + "sha256": "1154fd5cea7c419535bad4271edfc0930727f806a2420b04b9a1c2cf3a3f5146" + }, + { + "path": ".claude-plugin/plugin.json", + "sha256": "50ca2e7765bae7457ed6e488feeda9e989d381403238148105c8084c8f49125c" + }, + { + "path": "commands/check-session.md", + "sha256": "26981dafecd0bda9d89082c091325c9fdc3ac197318243e952dde0b1a38f4088" + }, + { + "path": "skills/session-security-checker/SKILL.md", + "sha256": "ff559b90685aaaa513f87e6365bdd994e1361eeb4b82df25237b40ba91a3f189" + }, + { + "path": "skills/session-security-checker/references/README.md", + "sha256": "5963d5832c100c4135b308922a90b781ec89a26851bf3a0eeca2bf122680d6cd" + }, + { + "path": "skills/session-security-checker/scripts/README.md", + "sha256": "a80c9944d3b50196030d6a5c3a924620b635e0d1a19b02b659a7c5aa5a05d598" + }, + { + "path": "skills/session-security-checker/assets/README.md", + "sha256": "cf7635fdd8ee093392015cd1994033956e7fb6e6fb5921de1ca6897f350e90c5" + } + ], + "dirSha256": "80dca2af1d1f29f22d237e2999100add002583c00e909a3f756699de69b40345" + }, + "security": { + "scannedAt": null, + "scannerVersion": null, + "flags": [] + } +} \ No newline at end of file diff --git a/skills/session-security-checker/SKILL.md b/skills/session-security-checker/SKILL.md new file mode 100644 index 0000000..7e0a47f --- /dev/null +++ b/skills/session-security-checker/SKILL.md @@ -0,0 +1,53 @@ +--- +name: checking-session-security +description: | + This skill enables Claude to check session security implementations within a codebase. It analyzes session management practices to identify potential vulnerabilities. Use this skill when a user requests to "check session security", "audit session handling", "review session implementation", or asks about "session security best practices" in their code. It helps identify issues like insecure session IDs, lack of proper session expiration, or insufficient protection against session fixation attacks. This skill leverages the session-security-checker plugin. Activates when you request "checking session security" functionality. +allowed-tools: Read, Write, Edit, Grep, Glob, Bash +version: 1.0.0 +--- + +## Overview + +This skill automates the process of reviewing session security within a project. It helps identify potential vulnerabilities related to session management, ensuring compliance with security best practices. + +## How It Works + +1. **Analyze Codebase**: The skill analyzes the codebase for session management related code. +2. **Identify Vulnerabilities**: It identifies potential vulnerabilities, such as weak session ID generation, missing session expiration, or susceptibility to session fixation. +3. **Generate Report**: The skill generates a report outlining the identified vulnerabilities and suggests remediation steps. + +## When to Use This Skill + +This skill activates when you need to: +- Check session security implementation. +- Audit session handling practices. +- Review session management code for vulnerabilities. +- Ensure compliance with session security best practices. + +## Examples + +### Example 1: Identifying Session Fixation Vulnerability + +User request: "Check session security in my web application." + +The skill will: +1. Analyze the code for session creation and management. +2. Identify if the application is vulnerable to session fixation attacks. + +### Example 2: Reviewing Session Expiration Settings + +User request: "Review session implementation to ensure proper expiration." + +The skill will: +1. Analyze the code to determine how session expiration is handled. +2. Identify if sessions are expiring correctly and suggest appropriate timeout values. + +## Best Practices + +- **Input Validation**: Always validate user input to prevent session hijacking. +- **Session Expiration**: Implement proper session expiration to minimize the risk of unauthorized access. +- **Secure Session IDs**: Use strong, randomly generated session IDs. + +## Integration + +This skill can be used in conjunction with other security plugins to provide a comprehensive security assessment of the codebase. For example, it can be used alongside a vulnerability scanner to identify other potential security flaws. \ No newline at end of file diff --git a/skills/session-security-checker/assets/README.md b/skills/session-security-checker/assets/README.md new file mode 100644 index 0000000..c25cf1b --- /dev/null +++ b/skills/session-security-checker/assets/README.md @@ -0,0 +1,6 @@ +# Assets + +Bundled resources for session-security-checker skill + +- [ ] report_template.html: An HTML template for generating the session security analysis report. +- [ ] vulnerability_descriptions.json: A JSON file containing detailed descriptions of common session security vulnerabilities. diff --git a/skills/session-security-checker/references/README.md b/skills/session-security-checker/references/README.md new file mode 100644 index 0000000..1ffdd28 --- /dev/null +++ b/skills/session-security-checker/references/README.md @@ -0,0 +1,7 @@ +# References + +Bundled resources for session-security-checker skill + +- [ ] session_security_best_practices.md: A document detailing session security best practices, including secure session ID generation, proper session expiration, and the use of secure flags. +- [ ] owasp_session_management_cheat_sheet.md: A reference to the OWASP Session Management Cheat Sheet, providing comprehensive guidance on secure session management. +- [ ] example_session_implementation.md: Example code snippets demonstrating secure session implementation in various languages (e.g., Python, JavaScript). diff --git a/skills/session-security-checker/scripts/README.md b/skills/session-security-checker/scripts/README.md new file mode 100644 index 0000000..f6af439 --- /dev/null +++ b/skills/session-security-checker/scripts/README.md @@ -0,0 +1,6 @@ +# Scripts + +Bundled resources for session-security-checker skill + +- [ ] session_security_scanner.py: A Python script to automate the session security checks, identifying vulnerabilities like weak session ID generation, improper session expiration, and lack of secure flags. +- [ ] report_generator.py: A script to generate a detailed report of the session security analysis, including identified vulnerabilities and recommended fixes.