Review and strengthen security in claude-flow v3 by addressing dependency risks, password hashing, credential generation, input validation, file paths, and command execution. It also guides threat modeling and tests for security-critical code.
Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for security-first v3 implementation.
Review the instructions the agent will receive before you install.
Orchestrates comprehensive security overhaul for claude-flow v3, addressing critical vulnerabilities and establishing security-first development practices using specialized v3 security agents.
# Initialize V3 security domain (parallel)
Task("Security architecture", "Design v3 threat model and security boundaries", "v3-security-architect")
Task("CVE remediation", "Fix CVE-1, CVE-2, CVE-3 critical vulnerabilities", "security-auditor")
Task("Security testing", "Implement TDD London School security framework", "test-architect")
npm update @anthropic-ai/claude-code@^2.0.31
npm audit --audit-level high
// ❌ Old: SHA-256 with hardcoded salt
const hash = crypto.createHash('sha256').update(password + salt).digest('hex');
// ✅ New: bcrypt with 12 rounds
import bcrypt from 'bcrypt';
const hash = await bcrypt.hash(password, 12);
// ✅ Generate secure random credentials
const apiKey = crypto.randomBytes(32).toString('hex');
import { z } from 'zod';
const TaskSchema = z.object({
taskId: z.string().uuid(),
content: z.string().max(10000),
agentType: z.enum(['security', 'core', 'integration'])
});
function securePath(userPath: string, allowedPrefix: string): string {
const resolved = path.resolve(allowedPrefix, userPath);
if (!resolved.startsWith(path.resolve(allowedPrefix))) {
throw new SecurityError('Path traversal detected');
}
return resolved;
}
import { execFile } from 'child_process';
// ✅ Safe: No shell interpretation
const { stdout } = await execFile('git', [userInput], { shell: false });
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Compare models available through the HuggingFace router with chat-ui configuration, research missing models, and write short English descriptions of their architecture and capabilities. Add entries to both production and development configuration files and commit the changes.
Build advanced AgentDB workflows with database synchronization, multiple databases, and search that combines meaning with attribute filters. Covers similarity measures, diverse search results, and operational patterns for distributed AI applications.
Create AgentDB learning plugins that use recorded experience to improve agent decisions. Choose a learning method, store states, actions, and rewards, train models, and evaluate suggested actions through CLI and API workflows.
Build AI agents that retain conversation history, user preferences, and useful interaction patterns with AgentDB. The skill covers persistent storage, meaning memories survive between sessions, plus retrieval, context management, and ReasoningBank integration.
Tune AgentDB memory use and search speed through quantization, which stores vectors more compactly, search indexes, caching, and batch operations. Includes configuration examples and benchmarks to help balance accuracy, speed, and storage as datasets grow.
Build document search with AgentDB that finds related content by meaning. Store documents as numerical representations, combine similarity search with metadata filters, and retrieve relevant passages for systems that generate answers using source material.