[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-atlassian-forge-security-review":3,"mdc-kr3ji8-key":39,"related-repo-atlassian-forge-security-review":938,"related-org-atlassian-forge-security-review":1019},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":34,"sourceUrl":37,"mdContent":38},"forge-security-review","perform security reviews for Forge apps","Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web trigger hardening, or static analysis execution for a Forge app.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"atlassian","Atlassian","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fatlassian.png",[12,16,19],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Audit","audit",{"name":20,"slug":21,"type":15},"Code Analysis","code-analysis",14,"https:\u002F\u002Fgithub.com\u002Fatlassian\u002Fforge-skills","2026-07-12T07:58:54.806538","Apache-2.0",7,[28,29,30,31,32,33],"agent-skills","ai-agents","claude-code-plugin","claude-code-skills","gemini-cli-extension","mcp",{"repoUrl":23,"stars":22,"forks":26,"topics":35,"description":36},[28,29,30,31,32,33],"The Forge Skills Plugin bundles several Forge-focused skills plus MCP-backed tooling so your agent can scaffold apps, review them before deploy, debug production issues, and stay current on Forge APIs and the Atlassian Design System.","https:\u002F\u002Fgithub.com\u002Fatlassian\u002Fforge-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fforge-security-review","---\nname: forge-security-review\ndescription: >\n  Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific\n  security rules and evidence-driven reporting. Use when the user asks for a Forge security\n  review, security audit, vuln assessment, pentest-style code review, authz review, tenant\n  isolation analysis, web trigger hardening, or static analysis execution for a Forge app.\nlicense: Apache-2.0\nlabels:\n  - forge\n  - security\n  - review\n  - audit\n  - atlassian\nmaintainer: atlassian-developer\nnamespace: cloud\n---\n\n# Forge Security Review\n\nRuns a Forge-focused white-box security review and reports validated findings with exploitability, impact, evidence, and remediation guidance.\n\n## Token-Efficient Default\n\nUse manifest-driven routing by default to reduce token usage. Do not load every rule file up front.\n\n## Rule Assets\n\nThe review rules are packaged with this skill under `assets\u002Fsecurity-rules\u002F`:\n\n- Global baseline: `assets\u002Fsecurity-rules\u002F_global-forge.mdc`\n- Category indexes: `assets\u002Fsecurity-rules\u002Fforge-*\u002F_index-*.mdc`\n- Category deep checks: `assets\u002Fsecurity-rules\u002Fforge-*\u002F*.mdc`\n\n## Execution Mandate\n\nWhen this skill is triggered:\n\n1. Run static analysis first from this skill directory:\n  - `scripts\u002Frun_static_analysis.sh \u003Cforge-project-root-directory>`\n  - use `.ps1` script for windows\n2. Read `manifest.yml` first before any deep code review.\n3. Load `assets\u002Fsecurity-rules\u002F_global-forge.mdc` first.\n4. Load only relevant category index rules based on manifest and code signals.\n5. Load deep subrules only when the matching detection heuristics are triggered by real code patterns.\n6. Perform an evidence-based security review across:\n   - AuthN\u002FAuthZ\n   - Injection and input validation\n   - Tenant isolation and cross-tenant leakage\n   - Secrets and storage\n   - Egress\u002Fremotes\u002FCSP and manifest permissions\n   - Public entry points (web triggers)\n   - Agent and miscellaneous Forge security risks\n7. Do not modify app code unless the user explicitly requests fixes.\n8. Write all scan outputs and generated artifacts to `security-audit-artifacts\u002F`.\n\n## Rule Routing Workflow\n\n### Phase 1: Reconnaissance (Mandatory)\n\nRead `manifest.yml` first and extract:\n\n- `permissions.scopes`\n- `permissions.external.fetch`\n- `permissions.content.scripts`\n- `modules` (resolver\u002Fwebtrigger\u002FscheduledTrigger\u002Frovo\u002Fetc.)\n- `remotes`\n- `app.runtime.name`\n\nBuild an execution map:\n\n- UI modules -> bridge calls -> resolvers\u002Ffunctions\n- External entry points (web triggers, events, schedules)\n- `api.asUser()` vs `api.asApp()` paths\n- Outbound fetch destinations\n\n### Phase 2: Index Rule Selection (Two-Tier Loading)\n\nAlways load first:\n\n- `assets\u002Fsecurity-rules\u002F_global-forge.mdc`\n\nThen load only relevant category index rules:\n\n| Signal                                                    | Load                                                                                   |\n| --------------------------------------------------------- | -------------------------------------------------------------------------------------- |\n| Any meaningful scope usage, mutations, or `asApp()` usage | `assets\u002Fsecurity-rules\u002Fforge-authn-authz\u002F_index-authn-authz.mdc`                       |\n| `webtrigger` or `scheduledTrigger` modules                | `assets\u002Fsecurity-rules\u002Fforge-webtrigger-entrypoints\u002F_index-webtrigger-entrypoints.mdc` |\n| `permissions.external.fetch` or `remotes`                 | `assets\u002Fsecurity-rules\u002Fforge-egress-remotes\u002F_index-egress-remotes.mdc`                 |\n| SQL APIs or untrusted input reaching resolver sinks       | `assets\u002Fsecurity-rules\u002Fforge-injection\u002F_index-injection.mdc`                           |\n| Multi-tenant patterns, module\u002Fglobal state, cache reuse   | `assets\u002Fsecurity-rules\u002Fforge-tenant-isolation\u002F_index-tenant-isolation.mdc`             |\n| Credentials\u002Ftokens\u002Fsecrets handling                       | `assets\u002Fsecurity-rules\u002Fforge-secrets-storage\u002F_index-secrets-storage.mdc`               |\n| Unsafe CSP or likely scope\u002Fconfig misconfiguration        | `assets\u002Fsecurity-rules\u002Fforge-manifest-config\u002F_index-manifest-config.mdc`               |\n| Rovo modules\u002Factions                                      | `assets\u002Fsecurity-rules\u002Fforge-rovo-agents\u002F_index-rovo-agents.mdc`                       |\n| Baseline logging\u002Ferror\u002Fstatic analysis concerns           | `assets\u002Fsecurity-rules\u002Fforge-auditing\u002F_index-auditing.mdc`                             |\n| Dependency\u002Fpackage risk review                            | `assets\u002Fsecurity-rules\u002Fforge-misc\u002F_index-misc.mdc`                                     |\n\nSubrule policy:\n\n- After reading an index, load only the subrules that match the detection heuristics observed in code.\n- Do not pre-load every subrule in a category.\n\n### Phase 3: Analysis and Verification\n\nFor each loaded category:\n\n1. Enumerate reachable entry points.\n2. Trace source -> validation\u002Fauthz -> sink.\n3. Confirm exploitability with evidence.\n4. Score confirmed findings with CVSS v3.1.\n\n## Focused Review Mode\n\nIf the user asks for a narrow review (for example, only authz), load:\n\n- Global baseline\n- Requested category index\n- Only matching subrules in that category\n\nStill mention any obvious critical findings observed outside scope.\n\n## Review Workflow\n\n1. Build an execution map:\n   - UI Kit\u002FCustom UI entry points\n   - Bridge invocations and resolver handlers\n   - `api.asUser()` \u002F `api.asApp()` call paths\n   - External egress\u002Fremotes and trigger entry points\n2. For each finding, trace source -> validation\u002Fauthz -> sink.\n3. Validate exploitability before classifying as a confirmed vulnerability.\n4. Keep non-exploitable hardening observations in a separate \"needs validation\" section.\n5. Provide file-level evidence and practical test leads for each issue.\n\n## Static Analysis Mode\n\nIf the user asks for a full scan, run the complete workflow from:\n\n- `assets\u002Fsecurity-rules\u002Fforge-auditing\u002Fstatic-analysis-forge.mdc`\n\nExpected tools (when available): Semgrep, npm audit, Snyk, gitleaks.\n\n## Output Requirements\n\n- Provide a markdown security audit report.\n- Order confirmed exploitable findings by CVSS v3.1 severity and impact.\n- Include for each confirmed finding:\n  - CVSS vector and base score\n  - Severity band\n  - Exploitability and impact\n  - File evidence and source-to-sink trace\n  - CWE mapping\n  - Reproducible PoC\u002Ftest steps with concrete commands\n- Include assumptions and evidence gaps.\n- Do not report scanner counts only when vulnerabilities exist.\n\n## Example Trigger Phrases\n\n- \"Review this Forge app for security\"\n- \"Do a white-box security audit of my Forge app\"\n- \"Check this app for authz bypass and tenant isolation issues\"\n- \"Run full static analysis for this Forge codebase\"\n",{"data":40,"body":46},{"name":4,"description":6,"license":25,"labels":41,"maintainer":44,"namespace":45},[42,14,43,18,8],"forge","review","atlassian-developer","cloud",{"type":47,"children":48},"root",[49,57,63,70,75,81,95,133,139,144,153,178,278,284,291,302,361,366,403,409,414,425,430,659,664,677,683,688,711,717,722,740,745,751,814,820,825,837,842,848,909,915],{"type":50,"tag":51,"props":52,"children":53},"element","h1",{"id":4},[54],{"type":55,"value":56},"text","Forge Security Review",{"type":50,"tag":58,"props":59,"children":60},"p",{},[61],{"type":55,"value":62},"Runs a Forge-focused white-box security review and reports validated findings with exploitability, impact, evidence, and remediation guidance.",{"type":50,"tag":64,"props":65,"children":67},"h2",{"id":66},"token-efficient-default",[68],{"type":55,"value":69},"Token-Efficient Default",{"type":50,"tag":58,"props":71,"children":72},{},[73],{"type":55,"value":74},"Use manifest-driven routing by default to reduce token usage. Do not load every rule file up front.",{"type":50,"tag":64,"props":76,"children":78},{"id":77},"rule-assets",[79],{"type":55,"value":80},"Rule Assets",{"type":50,"tag":58,"props":82,"children":83},{},[84,86,93],{"type":55,"value":85},"The review rules are packaged with this skill under ",{"type":50,"tag":87,"props":88,"children":90},"code",{"className":89},[],[91],{"type":55,"value":92},"assets\u002Fsecurity-rules\u002F",{"type":55,"value":94},":",{"type":50,"tag":96,"props":97,"children":98},"ul",{},[99,111,122],{"type":50,"tag":100,"props":101,"children":102},"li",{},[103,105],{"type":55,"value":104},"Global baseline: ",{"type":50,"tag":87,"props":106,"children":108},{"className":107},[],[109],{"type":55,"value":110},"assets\u002Fsecurity-rules\u002F_global-forge.mdc",{"type":50,"tag":100,"props":112,"children":113},{},[114,116],{"type":55,"value":115},"Category indexes: ",{"type":50,"tag":87,"props":117,"children":119},{"className":118},[],[120],{"type":55,"value":121},"assets\u002Fsecurity-rules\u002Fforge-*\u002F_index-*.mdc",{"type":50,"tag":100,"props":123,"children":124},{},[125,127],{"type":55,"value":126},"Category deep checks: ",{"type":50,"tag":87,"props":128,"children":130},{"className":129},[],[131],{"type":55,"value":132},"assets\u002Fsecurity-rules\u002Fforge-*\u002F*.mdc",{"type":50,"tag":64,"props":134,"children":136},{"id":135},"execution-mandate",[137],{"type":55,"value":138},"Execution Mandate",{"type":50,"tag":58,"props":140,"children":141},{},[142],{"type":55,"value":143},"When this skill is triggered:",{"type":50,"tag":145,"props":146,"children":147},"ol",{},[148],{"type":50,"tag":100,"props":149,"children":150},{},[151],{"type":55,"value":152},"Run static analysis first from this skill directory:",{"type":50,"tag":96,"props":154,"children":155},{},[156,165],{"type":50,"tag":100,"props":157,"children":158},{},[159],{"type":50,"tag":87,"props":160,"children":162},{"className":161},[],[163],{"type":55,"value":164},"scripts\u002Frun_static_analysis.sh \u003Cforge-project-root-directory>",{"type":50,"tag":100,"props":166,"children":167},{},[168,170,176],{"type":55,"value":169},"use ",{"type":50,"tag":87,"props":171,"children":173},{"className":172},[],[174],{"type":55,"value":175},".ps1",{"type":55,"value":177}," script for windows",{"type":50,"tag":145,"props":179,"children":181},{"start":180},2,[182,195,207,212,217,260,265],{"type":50,"tag":100,"props":183,"children":184},{},[185,187,193],{"type":55,"value":186},"Read ",{"type":50,"tag":87,"props":188,"children":190},{"className":189},[],[191],{"type":55,"value":192},"manifest.yml",{"type":55,"value":194}," first before any deep code review.",{"type":50,"tag":100,"props":196,"children":197},{},[198,200,205],{"type":55,"value":199},"Load ",{"type":50,"tag":87,"props":201,"children":203},{"className":202},[],[204],{"type":55,"value":110},{"type":55,"value":206}," first.",{"type":50,"tag":100,"props":208,"children":209},{},[210],{"type":55,"value":211},"Load only relevant category index rules based on manifest and code signals.",{"type":50,"tag":100,"props":213,"children":214},{},[215],{"type":55,"value":216},"Load deep subrules only when the matching detection heuristics are triggered by real code patterns.",{"type":50,"tag":100,"props":218,"children":219},{},[220,222],{"type":55,"value":221},"Perform an evidence-based security review across:\n",{"type":50,"tag":96,"props":223,"children":224},{},[225,230,235,240,245,250,255],{"type":50,"tag":100,"props":226,"children":227},{},[228],{"type":55,"value":229},"AuthN\u002FAuthZ",{"type":50,"tag":100,"props":231,"children":232},{},[233],{"type":55,"value":234},"Injection and input validation",{"type":50,"tag":100,"props":236,"children":237},{},[238],{"type":55,"value":239},"Tenant isolation and cross-tenant leakage",{"type":50,"tag":100,"props":241,"children":242},{},[243],{"type":55,"value":244},"Secrets and storage",{"type":50,"tag":100,"props":246,"children":247},{},[248],{"type":55,"value":249},"Egress\u002Fremotes\u002FCSP and manifest permissions",{"type":50,"tag":100,"props":251,"children":252},{},[253],{"type":55,"value":254},"Public entry points (web triggers)",{"type":50,"tag":100,"props":256,"children":257},{},[258],{"type":55,"value":259},"Agent and miscellaneous Forge security risks",{"type":50,"tag":100,"props":261,"children":262},{},[263],{"type":55,"value":264},"Do not modify app code unless the user explicitly requests fixes.",{"type":50,"tag":100,"props":266,"children":267},{},[268,270,276],{"type":55,"value":269},"Write all scan outputs and generated artifacts to ",{"type":50,"tag":87,"props":271,"children":273},{"className":272},[],[274],{"type":55,"value":275},"security-audit-artifacts\u002F",{"type":55,"value":277},".",{"type":50,"tag":64,"props":279,"children":281},{"id":280},"rule-routing-workflow",[282],{"type":55,"value":283},"Rule Routing Workflow",{"type":50,"tag":285,"props":286,"children":288},"h3",{"id":287},"phase-1-reconnaissance-mandatory",[289],{"type":55,"value":290},"Phase 1: Reconnaissance (Mandatory)",{"type":50,"tag":58,"props":292,"children":293},{},[294,295,300],{"type":55,"value":186},{"type":50,"tag":87,"props":296,"children":298},{"className":297},[],[299],{"type":55,"value":192},{"type":55,"value":301}," first and extract:",{"type":50,"tag":96,"props":303,"children":304},{},[305,314,323,332,343,352],{"type":50,"tag":100,"props":306,"children":307},{},[308],{"type":50,"tag":87,"props":309,"children":311},{"className":310},[],[312],{"type":55,"value":313},"permissions.scopes",{"type":50,"tag":100,"props":315,"children":316},{},[317],{"type":50,"tag":87,"props":318,"children":320},{"className":319},[],[321],{"type":55,"value":322},"permissions.external.fetch",{"type":50,"tag":100,"props":324,"children":325},{},[326],{"type":50,"tag":87,"props":327,"children":329},{"className":328},[],[330],{"type":55,"value":331},"permissions.content.scripts",{"type":50,"tag":100,"props":333,"children":334},{},[335,341],{"type":50,"tag":87,"props":336,"children":338},{"className":337},[],[339],{"type":55,"value":340},"modules",{"type":55,"value":342}," (resolver\u002Fwebtrigger\u002FscheduledTrigger\u002Frovo\u002Fetc.)",{"type":50,"tag":100,"props":344,"children":345},{},[346],{"type":50,"tag":87,"props":347,"children":349},{"className":348},[],[350],{"type":55,"value":351},"remotes",{"type":50,"tag":100,"props":353,"children":354},{},[355],{"type":50,"tag":87,"props":356,"children":358},{"className":357},[],[359],{"type":55,"value":360},"app.runtime.name",{"type":50,"tag":58,"props":362,"children":363},{},[364],{"type":55,"value":365},"Build an execution map:",{"type":50,"tag":96,"props":367,"children":368},{},[369,374,379,398],{"type":50,"tag":100,"props":370,"children":371},{},[372],{"type":55,"value":373},"UI modules -> bridge calls -> resolvers\u002Ffunctions",{"type":50,"tag":100,"props":375,"children":376},{},[377],{"type":55,"value":378},"External entry points (web triggers, events, schedules)",{"type":50,"tag":100,"props":380,"children":381},{},[382,388,390,396],{"type":50,"tag":87,"props":383,"children":385},{"className":384},[],[386],{"type":55,"value":387},"api.asUser()",{"type":55,"value":389}," vs ",{"type":50,"tag":87,"props":391,"children":393},{"className":392},[],[394],{"type":55,"value":395},"api.asApp()",{"type":55,"value":397}," paths",{"type":50,"tag":100,"props":399,"children":400},{},[401],{"type":55,"value":402},"Outbound fetch destinations",{"type":50,"tag":285,"props":404,"children":406},{"id":405},"phase-2-index-rule-selection-two-tier-loading",[407],{"type":55,"value":408},"Phase 2: Index Rule Selection (Two-Tier Loading)",{"type":50,"tag":58,"props":410,"children":411},{},[412],{"type":55,"value":413},"Always load first:",{"type":50,"tag":96,"props":415,"children":416},{},[417],{"type":50,"tag":100,"props":418,"children":419},{},[420],{"type":50,"tag":87,"props":421,"children":423},{"className":422},[],[424],{"type":55,"value":110},{"type":50,"tag":58,"props":426,"children":427},{},[428],{"type":55,"value":429},"Then load only relevant category index rules:",{"type":50,"tag":431,"props":432,"children":433},"table",{},[434,453],{"type":50,"tag":435,"props":436,"children":437},"thead",{},[438],{"type":50,"tag":439,"props":440,"children":441},"tr",{},[442,448],{"type":50,"tag":443,"props":444,"children":445},"th",{},[446],{"type":55,"value":447},"Signal",{"type":50,"tag":443,"props":449,"children":450},{},[451],{"type":55,"value":452},"Load",{"type":50,"tag":454,"props":455,"children":456},"tbody",{},[457,483,514,540,557,574,591,608,625,642],{"type":50,"tag":439,"props":458,"children":459},{},[460,474],{"type":50,"tag":461,"props":462,"children":463},"td",{},[464,466,472],{"type":55,"value":465},"Any meaningful scope usage, mutations, or ",{"type":50,"tag":87,"props":467,"children":469},{"className":468},[],[470],{"type":55,"value":471},"asApp()",{"type":55,"value":473}," usage",{"type":50,"tag":461,"props":475,"children":476},{},[477],{"type":50,"tag":87,"props":478,"children":480},{"className":479},[],[481],{"type":55,"value":482},"assets\u002Fsecurity-rules\u002Fforge-authn-authz\u002F_index-authn-authz.mdc",{"type":50,"tag":439,"props":484,"children":485},{},[486,505],{"type":50,"tag":461,"props":487,"children":488},{},[489,495,497,503],{"type":50,"tag":87,"props":490,"children":492},{"className":491},[],[493],{"type":55,"value":494},"webtrigger",{"type":55,"value":496}," or ",{"type":50,"tag":87,"props":498,"children":500},{"className":499},[],[501],{"type":55,"value":502},"scheduledTrigger",{"type":55,"value":504}," modules",{"type":50,"tag":461,"props":506,"children":507},{},[508],{"type":50,"tag":87,"props":509,"children":511},{"className":510},[],[512],{"type":55,"value":513},"assets\u002Fsecurity-rules\u002Fforge-webtrigger-entrypoints\u002F_index-webtrigger-entrypoints.mdc",{"type":50,"tag":439,"props":515,"children":516},{},[517,531],{"type":50,"tag":461,"props":518,"children":519},{},[520,525,526],{"type":50,"tag":87,"props":521,"children":523},{"className":522},[],[524],{"type":55,"value":322},{"type":55,"value":496},{"type":50,"tag":87,"props":527,"children":529},{"className":528},[],[530],{"type":55,"value":351},{"type":50,"tag":461,"props":532,"children":533},{},[534],{"type":50,"tag":87,"props":535,"children":537},{"className":536},[],[538],{"type":55,"value":539},"assets\u002Fsecurity-rules\u002Fforge-egress-remotes\u002F_index-egress-remotes.mdc",{"type":50,"tag":439,"props":541,"children":542},{},[543,548],{"type":50,"tag":461,"props":544,"children":545},{},[546],{"type":55,"value":547},"SQL APIs or untrusted input reaching resolver sinks",{"type":50,"tag":461,"props":549,"children":550},{},[551],{"type":50,"tag":87,"props":552,"children":554},{"className":553},[],[555],{"type":55,"value":556},"assets\u002Fsecurity-rules\u002Fforge-injection\u002F_index-injection.mdc",{"type":50,"tag":439,"props":558,"children":559},{},[560,565],{"type":50,"tag":461,"props":561,"children":562},{},[563],{"type":55,"value":564},"Multi-tenant patterns, module\u002Fglobal state, cache reuse",{"type":50,"tag":461,"props":566,"children":567},{},[568],{"type":50,"tag":87,"props":569,"children":571},{"className":570},[],[572],{"type":55,"value":573},"assets\u002Fsecurity-rules\u002Fforge-tenant-isolation\u002F_index-tenant-isolation.mdc",{"type":50,"tag":439,"props":575,"children":576},{},[577,582],{"type":50,"tag":461,"props":578,"children":579},{},[580],{"type":55,"value":581},"Credentials\u002Ftokens\u002Fsecrets handling",{"type":50,"tag":461,"props":583,"children":584},{},[585],{"type":50,"tag":87,"props":586,"children":588},{"className":587},[],[589],{"type":55,"value":590},"assets\u002Fsecurity-rules\u002Fforge-secrets-storage\u002F_index-secrets-storage.mdc",{"type":50,"tag":439,"props":592,"children":593},{},[594,599],{"type":50,"tag":461,"props":595,"children":596},{},[597],{"type":55,"value":598},"Unsafe CSP or likely scope\u002Fconfig misconfiguration",{"type":50,"tag":461,"props":600,"children":601},{},[602],{"type":50,"tag":87,"props":603,"children":605},{"className":604},[],[606],{"type":55,"value":607},"assets\u002Fsecurity-rules\u002Fforge-manifest-config\u002F_index-manifest-config.mdc",{"type":50,"tag":439,"props":609,"children":610},{},[611,616],{"type":50,"tag":461,"props":612,"children":613},{},[614],{"type":55,"value":615},"Rovo modules\u002Factions",{"type":50,"tag":461,"props":617,"children":618},{},[619],{"type":50,"tag":87,"props":620,"children":622},{"className":621},[],[623],{"type":55,"value":624},"assets\u002Fsecurity-rules\u002Fforge-rovo-agents\u002F_index-rovo-agents.mdc",{"type":50,"tag":439,"props":626,"children":627},{},[628,633],{"type":50,"tag":461,"props":629,"children":630},{},[631],{"type":55,"value":632},"Baseline logging\u002Ferror\u002Fstatic analysis concerns",{"type":50,"tag":461,"props":634,"children":635},{},[636],{"type":50,"tag":87,"props":637,"children":639},{"className":638},[],[640],{"type":55,"value":641},"assets\u002Fsecurity-rules\u002Fforge-auditing\u002F_index-auditing.mdc",{"type":50,"tag":439,"props":643,"children":644},{},[645,650],{"type":50,"tag":461,"props":646,"children":647},{},[648],{"type":55,"value":649},"Dependency\u002Fpackage risk review",{"type":50,"tag":461,"props":651,"children":652},{},[653],{"type":50,"tag":87,"props":654,"children":656},{"className":655},[],[657],{"type":55,"value":658},"assets\u002Fsecurity-rules\u002Fforge-misc\u002F_index-misc.mdc",{"type":50,"tag":58,"props":660,"children":661},{},[662],{"type":55,"value":663},"Subrule policy:",{"type":50,"tag":96,"props":665,"children":666},{},[667,672],{"type":50,"tag":100,"props":668,"children":669},{},[670],{"type":55,"value":671},"After reading an index, load only the subrules that match the detection heuristics observed in code.",{"type":50,"tag":100,"props":673,"children":674},{},[675],{"type":55,"value":676},"Do not pre-load every subrule in a category.",{"type":50,"tag":285,"props":678,"children":680},{"id":679},"phase-3-analysis-and-verification",[681],{"type":55,"value":682},"Phase 3: Analysis and Verification",{"type":50,"tag":58,"props":684,"children":685},{},[686],{"type":55,"value":687},"For each loaded category:",{"type":50,"tag":145,"props":689,"children":690},{},[691,696,701,706],{"type":50,"tag":100,"props":692,"children":693},{},[694],{"type":55,"value":695},"Enumerate reachable entry points.",{"type":50,"tag":100,"props":697,"children":698},{},[699],{"type":55,"value":700},"Trace source -> validation\u002Fauthz -> sink.",{"type":50,"tag":100,"props":702,"children":703},{},[704],{"type":55,"value":705},"Confirm exploitability with evidence.",{"type":50,"tag":100,"props":707,"children":708},{},[709],{"type":55,"value":710},"Score confirmed findings with CVSS v3.1.",{"type":50,"tag":64,"props":712,"children":714},{"id":713},"focused-review-mode",[715],{"type":55,"value":716},"Focused Review Mode",{"type":50,"tag":58,"props":718,"children":719},{},[720],{"type":55,"value":721},"If the user asks for a narrow review (for example, only authz), load:",{"type":50,"tag":96,"props":723,"children":724},{},[725,730,735],{"type":50,"tag":100,"props":726,"children":727},{},[728],{"type":55,"value":729},"Global baseline",{"type":50,"tag":100,"props":731,"children":732},{},[733],{"type":55,"value":734},"Requested category index",{"type":50,"tag":100,"props":736,"children":737},{},[738],{"type":55,"value":739},"Only matching subrules in that category",{"type":50,"tag":58,"props":741,"children":742},{},[743],{"type":55,"value":744},"Still mention any obvious critical findings observed outside scope.",{"type":50,"tag":64,"props":746,"children":748},{"id":747},"review-workflow",[749],{"type":55,"value":750},"Review Workflow",{"type":50,"tag":145,"props":752,"children":753},{},[754,794,799,804,809],{"type":50,"tag":100,"props":755,"children":756},{},[757,759],{"type":55,"value":758},"Build an execution map:\n",{"type":50,"tag":96,"props":760,"children":761},{},[762,767,772,789],{"type":50,"tag":100,"props":763,"children":764},{},[765],{"type":55,"value":766},"UI Kit\u002FCustom UI entry points",{"type":50,"tag":100,"props":768,"children":769},{},[770],{"type":55,"value":771},"Bridge invocations and resolver handlers",{"type":50,"tag":100,"props":773,"children":774},{},[775,780,782,787],{"type":50,"tag":87,"props":776,"children":778},{"className":777},[],[779],{"type":55,"value":387},{"type":55,"value":781}," \u002F ",{"type":50,"tag":87,"props":783,"children":785},{"className":784},[],[786],{"type":55,"value":395},{"type":55,"value":788}," call paths",{"type":50,"tag":100,"props":790,"children":791},{},[792],{"type":55,"value":793},"External egress\u002Fremotes and trigger entry points",{"type":50,"tag":100,"props":795,"children":796},{},[797],{"type":55,"value":798},"For each finding, trace source -> validation\u002Fauthz -> sink.",{"type":50,"tag":100,"props":800,"children":801},{},[802],{"type":55,"value":803},"Validate exploitability before classifying as a confirmed vulnerability.",{"type":50,"tag":100,"props":805,"children":806},{},[807],{"type":55,"value":808},"Keep non-exploitable hardening observations in a separate \"needs validation\" section.",{"type":50,"tag":100,"props":810,"children":811},{},[812],{"type":55,"value":813},"Provide file-level evidence and practical test leads for each issue.",{"type":50,"tag":64,"props":815,"children":817},{"id":816},"static-analysis-mode",[818],{"type":55,"value":819},"Static Analysis Mode",{"type":50,"tag":58,"props":821,"children":822},{},[823],{"type":55,"value":824},"If the user asks for a full scan, run the complete workflow from:",{"type":50,"tag":96,"props":826,"children":827},{},[828],{"type":50,"tag":100,"props":829,"children":830},{},[831],{"type":50,"tag":87,"props":832,"children":834},{"className":833},[],[835],{"type":55,"value":836},"assets\u002Fsecurity-rules\u002Fforge-auditing\u002Fstatic-analysis-forge.mdc",{"type":50,"tag":58,"props":838,"children":839},{},[840],{"type":55,"value":841},"Expected tools (when available): Semgrep, npm audit, Snyk, gitleaks.",{"type":50,"tag":64,"props":843,"children":845},{"id":844},"output-requirements",[846],{"type":55,"value":847},"Output Requirements",{"type":50,"tag":96,"props":849,"children":850},{},[851,856,861,899,904],{"type":50,"tag":100,"props":852,"children":853},{},[854],{"type":55,"value":855},"Provide a markdown security audit report.",{"type":50,"tag":100,"props":857,"children":858},{},[859],{"type":55,"value":860},"Order confirmed exploitable findings by CVSS v3.1 severity and impact.",{"type":50,"tag":100,"props":862,"children":863},{},[864,866],{"type":55,"value":865},"Include for each confirmed finding:\n",{"type":50,"tag":96,"props":867,"children":868},{},[869,874,879,884,889,894],{"type":50,"tag":100,"props":870,"children":871},{},[872],{"type":55,"value":873},"CVSS vector and base score",{"type":50,"tag":100,"props":875,"children":876},{},[877],{"type":55,"value":878},"Severity band",{"type":50,"tag":100,"props":880,"children":881},{},[882],{"type":55,"value":883},"Exploitability and impact",{"type":50,"tag":100,"props":885,"children":886},{},[887],{"type":55,"value":888},"File evidence and source-to-sink trace",{"type":50,"tag":100,"props":890,"children":891},{},[892],{"type":55,"value":893},"CWE mapping",{"type":50,"tag":100,"props":895,"children":896},{},[897],{"type":55,"value":898},"Reproducible PoC\u002Ftest steps with concrete commands",{"type":50,"tag":100,"props":900,"children":901},{},[902],{"type":55,"value":903},"Include assumptions and evidence gaps.",{"type":50,"tag":100,"props":905,"children":906},{},[907],{"type":55,"value":908},"Do not report scanner counts only when vulnerabilities exist.",{"type":50,"tag":64,"props":910,"children":912},{"id":911},"example-trigger-phrases",[913],{"type":55,"value":914},"Example Trigger Phrases",{"type":50,"tag":96,"props":916,"children":917},{},[918,923,928,933],{"type":50,"tag":100,"props":919,"children":920},{},[921],{"type":55,"value":922},"\"Review this Forge app for security\"",{"type":50,"tag":100,"props":924,"children":925},{},[926],{"type":55,"value":927},"\"Do a white-box security audit of my Forge app\"",{"type":50,"tag":100,"props":929,"children":930},{},[931],{"type":55,"value":932},"\"Check this app for authz bypass and tenant isolation issues\"",{"type":50,"tag":100,"props":934,"children":935},{},[936],{"type":55,"value":937},"\"Run full static analysis for this Forge codebase\"",{"items":939,"total":1018},[940,957,970,986,1000,1012],{"slug":941,"name":941,"fn":942,"description":943,"org":944,"tags":945,"stars":22,"repoUrl":23,"updatedAt":956},"forge-app-builder","build and deploy Atlassian Forge apps","Guides building, deploying, troubleshooting, and installing Atlassian Forge apps — custom extensions built with the Forge CLI (forge create, forge deploy, forge install). Use when the user wants to create a Forge app (issue panels, dashboard gadgets, Confluence macros, global pages), is encountering Forge CLI errors or deployment issues (e.g. forge install failures, environment errors), or needs help with Forge-specific concepts like resolvers, UI Kit, manifest scopes, or developer spaces. Do not use for general Jira configuration, automation rules, JQL queries, or Atlassian REST API usage outside of a Forge app context.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[946,947,950,953],{"name":9,"slug":8,"type":15},{"name":948,"slug":949,"type":15},"CLI","cli",{"name":951,"slug":952,"type":15},"Deployment","deployment",{"name":954,"slug":955,"type":15},"Plugin Development","plugin-development","2026-07-12T07:58:52.007851",{"slug":958,"name":958,"fn":959,"description":960,"org":961,"tags":962,"stars":22,"repoUrl":23,"updatedAt":969},"forge-app-review","review Atlassian Forge app readiness","Performs a lightweight pre-release readiness review of Atlassian Forge apps across manifest\u002Fmodule wiring, architecture, runtime compatibility, dependency posture, tests, deploy readiness, and obvious security, cost, or reliability smells. Use when the user asks \"review my Forge app\", \"pre-deploy check\", \"is this app ready to ship\", \"review manifest\", \"general app review\", \"release readiness\", or asks for a broad quality pass. Do not use for deep security audits\u002FSAST\u002Fexploitability review, cost optimization, or diagnosing a known broken app; route those to forge-security-review, forge-cost-optimizer, or forge-debugger respectively.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[963,964,965,966],{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":951,"slug":952,"type":15},{"name":967,"slug":968,"type":15},"QA","qa","2026-07-12T07:58:50.744672",{"slug":971,"name":971,"fn":972,"description":973,"org":974,"tags":975,"stars":22,"repoUrl":23,"updatedAt":985},"forge-connector","build Atlassian Forge Teamwork Graph connectors","Guides building and deploying Atlassian Forge Teamwork Graph connector apps that ingest external data into Atlassian's Teamwork Graph, making it searchable in Rovo Search and surfaced in Rovo Chat. Use when the user wants to build a Forge connector, ingest external data into Atlassian, connect a third-party tool (e.g. Google Drive, ServiceNow, Salesforce) to Atlassian, make external content searchable in Rovo, build a graph:connector module, use the @forge\u002Fteamwork-graph SDK, or implement onConnectionChange \u002F validateConnection functions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[976,979,982],{"name":977,"slug":978,"type":15},"API Development","api-development",{"name":980,"slug":981,"type":15},"Engineering","engineering",{"name":983,"slug":984,"type":15},"Enterprise Search","enterprise-search","2026-07-12T07:58:48.520248",{"slug":987,"name":987,"fn":988,"description":989,"org":990,"tags":991,"stars":22,"repoUrl":23,"updatedAt":999},"forge-cost-optimizer","optimize Atlassian Forge platform costs","Optimizes Atlassian Forge apps to reduce platform consumption and avoid unnecessary costs using Atlassian's \"Optimise Forge platform costs\" guidance. Use when the user asks to optimize Forge app costs, reduce Forge invocations, lower GB-seconds, reduce storage or log usage, tune memory, replace polling, improve scheduled triggers, reduce KVS writes, move work to the frontend, use bridge APIs, batch API calls, add caching, or evaluate Forge Remote trade-offs. By default, perform an audit first and offer to make the recommended changes after presenting the audit. Only modify files immediately when the user explicitly asks the agent to implement or apply optimizations.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[992,993,996],{"name":9,"slug":8,"type":15},{"name":994,"slug":995,"type":15},"Cost Optimization","cost-optimization",{"name":997,"slug":998,"type":15},"Operations","operations","2026-07-12T07:58:53.557299",{"slug":1001,"name":1001,"fn":1002,"description":1003,"org":1004,"tags":1005,"stars":22,"repoUrl":23,"updatedAt":1011},"forge-debugger","diagnose and fix Atlassian Forge apps","Diagnoses and fixes issues in Atlassian Forge apps. Use this skill whenever a Forge app has errors, crashes, shows blank UI, fails to deploy, doesn't appear after installation, has permission issues, or produces unexpected output. Trigger on any mention of forge logs, forge deploy errors, resolver errors, blank panels, missing scopes, Custom UI not rendering, production vs dev discrepancies, or any Jira\u002FConfluence app that \"stopped working\". Also trigger when the user asks to debug, troubleshoot, investigate, or fix a Forge app issue — even if they haven't used the word \"Forge\" but describe a Jira panel or Confluence macro acting up.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1006,1007,1010],{"name":9,"slug":8,"type":15},{"name":1008,"slug":1009,"type":15},"Debugging","debugging",{"name":951,"slug":952,"type":15},"2026-07-12T07:58:47.226713",{"slug":4,"name":4,"fn":5,"description":6,"org":1013,"tags":1014,"stars":22,"repoUrl":23,"updatedAt":24},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1015,1016,1017],{"name":17,"slug":18,"type":15},{"name":20,"slug":21,"type":15},{"name":13,"slug":14,"type":15},6,{"items":1020,"total":1152},[1021,1042,1060,1077,1090,1101,1114,1121,1128,1134,1140,1146],{"slug":1022,"name":1022,"fn":1023,"description":1024,"org":1025,"tags":1026,"stars":1039,"repoUrl":1040,"updatedAt":1041},"capture-tasks-from-meeting-notes","create Jira tasks from meeting notes","Analyze meeting notes to find action items and create Jira tasks for assigned work. When an agent needs to: (1) Create Jira tasks or tickets from meeting notes, (2) Extract or find action items from notes or Confluence pages, (3) Parse meeting notes for assigned tasks, or (4) Analyze notes and generate tasks for team members. Identifies assignees, looks up account IDs, and creates tasks with proper context.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1027,1030,1033,1036],{"name":1028,"slug":1029,"type":15},"Automation","automation",{"name":1031,"slug":1032,"type":15},"Jira","jira",{"name":1034,"slug":1035,"type":15},"Meetings","meetings",{"name":1037,"slug":1038,"type":15},"Task Management","task-management",848,"https:\u002F\u002Fgithub.com\u002Fatlassian\u002Fatlassian-mcp-server","2026-07-12T07:58:45.323861",{"slug":1043,"name":1043,"fn":1044,"description":1045,"org":1046,"tags":1047,"stars":1039,"repoUrl":1040,"updatedAt":1059},"generate-status-report","generate project status reports for Confluence","Generate project status reports from Jira issues and publish to Confluence. When an agent needs to: (1) Create a status report for a project, (2) Summarize project progress or updates, (3) Generate weekly\u002Fdaily reports from Jira, (4) Publish status summaries to Confluence, or (5) Analyze project blockers and completion. Queries Jira issues, categorizes by status\u002Fpriority, and creates formatted reports for delivery managers and executives.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1048,1049,1052,1053,1056],{"name":9,"slug":8,"type":15},{"name":1050,"slug":1051,"type":15},"Confluence","confluence",{"name":1031,"slug":1032,"type":15},{"name":1054,"slug":1055,"type":15},"Project Management","project-management",{"name":1057,"slug":1058,"type":15},"Reporting","reporting","2026-07-12T07:58:38.457696",{"slug":1061,"name":1061,"fn":1062,"description":1063,"org":1064,"tags":1065,"stars":1039,"repoUrl":1040,"updatedAt":1076},"jira-sprint-dashboard","create Jira sprint dashboards","Create a visual Jira sprint dashboard from Jira project, space, sprint, board, filter, JQL, work item keys, or Jira URL data. Use when the user asks for a Jira sprint dashboard, standup dashboard, sprint review, delivery review, engineering manager dashboard, WIP review, planning view, closeout view, or a visual snapshot of Jira work that is more useful than a flat report. Use the richest dashboard format supported by the current agent, such as Cursor Canvas, an interactive artifact, HTML, or Markdown.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1066,1069,1072,1073],{"name":1067,"slug":1068,"type":15},"Agile","agile",{"name":1070,"slug":1071,"type":15},"Dashboards","dashboards",{"name":1031,"slug":1032,"type":15},{"name":1074,"slug":1075,"type":15},"Sprint Planning","sprint-planning","2026-07-12T07:58:41.031798",{"slug":1078,"name":1078,"fn":1079,"description":1080,"org":1081,"tags":1082,"stars":1039,"repoUrl":1040,"updatedAt":1089},"search-company-knowledge","search internal company knowledge bases","Search across company knowledge bases (Confluence, Jira, internal docs) to find and explain internal concepts, processes, and technical details. When an agent needs to: (1) Find or search for information about systems, terminology, processes, deployment, authentication, infrastructure, architecture, or technical concepts, (2) Search internal documentation, knowledge base, company docs, or our docs, (3) Explain what something is, how it works, or look up information, or (4) Synthesize information from multiple sources. Searches in parallel and provides cited answers.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1083,1084,1085,1086],{"name":1050,"slug":1051,"type":15},{"name":983,"slug":984,"type":15},{"name":1031,"slug":1032,"type":15},{"name":1087,"slug":1088,"type":15},"Knowledge Management","knowledge-management","2026-07-12T07:58:39.684132",{"slug":1091,"name":1091,"fn":1092,"description":1093,"org":1094,"tags":1095,"stars":1039,"repoUrl":1040,"updatedAt":1100},"spec-to-backlog","convert Confluence specifications to Jira backlogs","Automatically convert Confluence specification documents into structured Jira backlogs with Epics and implementation tickets. When an agent needs to: (1) Create Jira tickets from a Confluence page, (2) Generate a backlog from a specification, (3) Break down a spec into implementation tasks, or (4) Convert requirements into Jira issues. Handles reading Confluence pages, analyzing specifications, creating Epics with proper structure, and generating detailed implementation tickets linked to the Epic.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1096,1097,1098,1099],{"name":1067,"slug":1068,"type":15},{"name":1050,"slug":1051,"type":15},{"name":1031,"slug":1032,"type":15},{"name":1054,"slug":1055,"type":15},"2026-07-12T07:58:37.200385",{"slug":1102,"name":1102,"fn":1103,"description":1104,"org":1105,"tags":1106,"stars":1039,"repoUrl":1040,"updatedAt":1113},"triage-issue","triage bug reports in Jira","Intelligently triage bug reports and error messages by searching for duplicates in Jira and offering to create new issues or add comments to existing ones. When an agent needs to: (1) Triage a bug report or error message, (2) Check if an issue is a duplicate, (3) Find similar past issues, (4) Create a new bug ticket with proper context, or (5) Add information to an existing ticket. Searches Jira for similar issues, identifies duplicates, checks fix history, and helps create well-structured bug reports.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1107,1108,1109,1110],{"name":1008,"slug":1009,"type":15},{"name":1031,"slug":1032,"type":15},{"name":1054,"slug":1055,"type":15},{"name":1111,"slug":1112,"type":15},"Triage","triage","2026-07-12T07:58:33.007343",{"slug":941,"name":941,"fn":942,"description":943,"org":1115,"tags":1116,"stars":22,"repoUrl":23,"updatedAt":956},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1117,1118,1119,1120],{"name":9,"slug":8,"type":15},{"name":948,"slug":949,"type":15},{"name":951,"slug":952,"type":15},{"name":954,"slug":955,"type":15},{"slug":958,"name":958,"fn":959,"description":960,"org":1122,"tags":1123,"stars":22,"repoUrl":23,"updatedAt":969},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1124,1125,1126,1127],{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":951,"slug":952,"type":15},{"name":967,"slug":968,"type":15},{"slug":971,"name":971,"fn":972,"description":973,"org":1129,"tags":1130,"stars":22,"repoUrl":23,"updatedAt":985},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1131,1132,1133],{"name":977,"slug":978,"type":15},{"name":980,"slug":981,"type":15},{"name":983,"slug":984,"type":15},{"slug":987,"name":987,"fn":988,"description":989,"org":1135,"tags":1136,"stars":22,"repoUrl":23,"updatedAt":999},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1137,1138,1139],{"name":9,"slug":8,"type":15},{"name":994,"slug":995,"type":15},{"name":997,"slug":998,"type":15},{"slug":1001,"name":1001,"fn":1002,"description":1003,"org":1141,"tags":1142,"stars":22,"repoUrl":23,"updatedAt":1011},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1143,1144,1145],{"name":9,"slug":8,"type":15},{"name":1008,"slug":1009,"type":15},{"name":951,"slug":952,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":1147,"tags":1148,"stars":22,"repoUrl":23,"updatedAt":24},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1149,1150,1151],{"name":17,"slug":18,"type":15},{"name":20,"slug":21,"type":15},{"name":13,"slug":14,"type":15},24]