security-guidance
Security reminders when an edit adds a dangerous pattern (eval, pickle, shell=True, raw innerHTML, disabled TLS...), an opt-in AI review of the diff at end of turn and after each commit, and /security-review on demand.
Reference
| Field | Value |
|---|---|
| Name | security-guidance |
| Version | 1.0.0 |
| Category | Security |
| Licence | Not declared |
| Source | catalog/navin/builtin_plugins/security-guidance/plugin.json |
| README | catalog/navin/builtin_plugins/security-guidance/README.md |
| Digest | sha256:631bd663b1ae8ebfacd924216c32d26e7f8f06e7909d52970769e9f95ce85d9a |
| plugin.json | agents, category, commands, description, name, skills, steps, version |
Commands
| Name | Arguments | Description |
|---|---|---|
/security-review | [base ref or commit range, default: uncommitted changes] | Review the pending changes (or a commit range) for exploitable security vulnerabilities |
Agents
| Name | Tools | Model | Description |
|---|---|---|---|
code-reviewer | read_file, grep, find_files, list_dir, code_index, lsp, code_review, web_fetch, web_search | - | Reviews code for bugs, logic errors, security flaws, quality problems and project-convention breaches, scoring each finding for confidence and reporting only the high-priority ones. Use when code was written or changed and needs a review before it is merged. |
Skills
| Name | Description |
|---|---|
| security-auditor | Run a full application security audit - auth flows, input validation, secrets handling, injection surfaces, dependency risks, and hardening. |
Hooks, MCP servers and settings
plugin.json declares no hook, no MCP server and no setting: the plugin is made of the components above only.
Workflow
| Step | Use |
|---|---|
| warn on dangerous patterns in edited files (automatic) | skill:security-auditor |
| review the pending changes or a commit range | /security-review |
| split a large review by area | agent:code-reviewer |
Enable it in a project
Activating security-guidance creates 4 activations in the project: the plugin itself, 1 skill, 1 command and 1 agent. Removing the plugin activation removes them all.
curl -X POST <control-plane-url>/v1/projects/<project>/navin-library/activations \
-H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
-d '{"kind": "plugin", "name": "security-guidance"}'
<project>: id or slug of the project. <token>: API key with the editor role on the project.
client.navin_library.activate("<project>", "plugin", "security-guidance")