Agent-Skills.md

Agent Skills: Batch Security Migration

Use when applying the same security fix across many files or repos at once — large-scale vulnerability remediation. Provides 7 copy-paste /batch recipes (XSS, HTTPS, SQLi, input validation, log PII, secret rotation, CVE patches) each with a safety tier and false-positive trap, plus scan_diff.py to prove the migration introduced no new HIGH/CRITICAL findings.

UncategorizedID: diegocconsolini/ClaudeSkillCollection/batch-security-migration

Repository

diegocconsolini/ClaudeSkillCollection
diegocconsoliniLicense: MIT
6

Install this agent skill to your local

pnpm dlx add-skill https://github.com/diegocconsolini/ClaudeSkillCollection/tree/HEAD/batch-security-migration

Skill Files

Browse the full folder contents for batch-security-migration.

Download Skill

Loading file tree…

batch-security-migration/SKILL.md

Skill Metadata

Name
batch-security-migration
Description
Use when applying the same security fix across many files or repos at once — large-scale vulnerability remediation. Provides 7 copy-paste /batch recipes (XSS, HTTPS, SQLi, input validation, log PII, secret rotation, CVE patches) each with a safety tier and false-positive trap, plus scan_diff.py to prove the migration introduced no new HIGH/CRITICAL findings.

Batch Security Migration

Turn Claude Code's built-in /batch into a security-migration tool. This skill does not reinvent /batch — /batch already fans work out into worktree-isolated per-unit PRs. This skill supplies the recipes, the safety tiers, and an objective before/after gate (scripts/scan_diff.py).

When to use

You have the same vulnerability class in many places (dozens of files, or many repos) and want to fix them in one coordinated pass with per-unit review and a regression gate.

Safety tiers

| Tier | Meaning | |---|---| | 🟢 safe | Mechanical text substitution; review only the flagged dynamic cases. | | 🟡 review | Semantic change; the per-unit PR review is the gate. | | 🔴 manual | Never full-auto — high blast radius. Drive /batch one unit at a time with a human + test run per unit. |

Pre-scan checklist

  1. Clean git tree (git status empty) — /batch needs a clean base.
  2. Run a baseline scan: scan_plugin.py <target> --output before.json --format json.
  3. Confirm /batch is available (Claude Code ≥ 2.1.63).
  4. Scope to a subdirectory first; don't run repo-wide on the first pass.
  5. Ensure the existing test suite passes before you start.

Recipes

| # | Recipe | Tier | False-positive trap | Verify | |---|---|---|---|---| | 1 | XSS: innerHTML → textContent | 🟢 safe | dynamic-HTML assignment is intentional in a few spots | grep should drop for static cases | | 2 | HTTPS: http:// → https:// | 🟢 safe | localhost / 127.0.0.1 / example URLs must be excluded | no http:// outside the allowlist | | 3 | SQLi: string-concat → parameterized | 🟡 review | not every concatenated string is a query | per-unit PR review | | 4 | Input validation on route handlers | 🟡 review | may add a dependency; verify handler coverage | tests + handler list | | 5 | Log sanitization: strip PII from logs | 🟡 review | regex over-match can corrupt non-PII logs | check redaction correctness | | 6 | Secret rotation: hardcoded key → env var | 🔴 manual | test fixtures look like real secrets | manual per unit + secret scan | | 7 | Dependency CVE patch updates | 🔴 manual | a patch can break an API | test run per bump |

1. XSS: innerHTML → textContent (🟢)

/batch over files matching grep -rl 'innerHTML' src/: "Replace element.innerHTML = x with element.textContent = x where x is plain text. Leave intentional HTML injection (templating, sanitized fragments) and add a // reviewed: dynamic HTML comment instead." Verify: grep -rn 'innerHTML' src/ returns only reviewed cases.

2. HTTPS: http:// → https:// (🟢)

/batch: "Replace http:// with https:// in source and config. Do NOT touch localhost, 127.0.0.1, 0.0.0.0, example.com, or XML namespace URIs." Verify: grep -rn 'http://' . | grep -v -E 'localhost|127\.0\.0\.1|example\.' is empty.

3. SQLi: parameterized queries (🟡)

/batch: "Convert string-concatenated SQL into parameterized queries for the driver in use. Each file is its own PR — flag any query you can't safely parameterize." Review every per-unit PR; this is semantic.

4. Input validation on route handlers (🟡)

/batch: "Add input validation to each Express/route handler using the project's existing validation library. If none exists, flag the unit instead of adding a new dependency." Verify handler coverage and that no unintended dependency was added.

5. Log sanitization: strip PII (🟡)

/batch: "Wrap log statements that emit email/SSN/credit-card values in the project's redaction helper. Don't redact non-PII." Check redaction correctness — regexes over-match.

6. Secret rotation: hardcoded key → env var (🔴 manual)

Drive /batch one unit at a time. "Replace a hardcoded secret with os.environ[...] / process.env... and add it to .env.example." Trap: test fixtures and example keys look like real secrets — never full-auto. After: rotate every real key that was exposed.

7. Dependency CVE patch updates (🔴 manual)

Drive /batch one bump at a time. "Update <pkg> to the patched version for <CVE>." Trap: patches can break APIs — run the full test suite per bump before merging.

Post-migration workflow

  1. Merge the per-unit PRs /batch produced.
  2. Re-scan: scan_plugin.py <target> --output after.json --format json.
  3. Gate: python3 scripts/scan_diff.py before.json after.json
    • exit 0 + "GATE: PASS" → no new HIGH/CRITICAL; ship.
    • exit 1 + "GATE: FAIL" → triage the listed NEW findings, or re-run with --report-only once you've justified them.

Or let scan_diff run both scans for you: python3 scripts/scan_diff.py --scan <target_before> <target_after>