Bitrix Marketplace Security Skills
AI Security Skills
A skill set for security-auditing Bitrix PHP modules before Marketplace submission: scan, severity review, a running journal
- 7 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- Only reads module code and writes local JSON reports; it does not connect to a live portal
Install
- Works in
- Services
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/ai-security-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- Only reads module code and writes local JSON reports; it does not connect to a live portal
This is third-party code. Review the repository files before installing.
What it does
The project provides a reproducible security workflow made of several skills. Scan runs a two-phase audit of one module: a deterministic recon pass over the code (controllers, AJAX entry points, admin files, handlers, dangerous sinks, aware of Bitrix specifics like ActionFilter and check_bitrix_sessid) followed by a focused review of the findings, saved as a JSON report. Journal-review re-evaluates the raw findings' severity with Bitrix and BUS context in mind (data source, user rights, real exploitability), adding a rationale and confidence level. Journal-update maintains a cumulative security-journal.json across repeated runs with statuses like open. An interactive orchestrator, using-marketplace-sec, ships a local Chart.js UI, and scan-composer offers a single-command headless alternative.
Who it is for. For Bitrix module developers preparing a solution for Marketplace submission who want a reproducible security audit beforehand.
Good fit when
- You are preparing a Bitrix PHP module for Marketplace submission and need a pre-submission security audit
- You need a cumulative vulnerability journal across repeated runs, not a one-off report
- You need severity adjusted for Bitrix specifics, not a raw scanner dump
Not a fit when
- Your module is not PHP or not built for the Bitrix platform
- You need the Marketplace's own official moderation process, not a preliminary local audit
- You need continuous production monitoring, not a one-off pre-submission check
Example request
Run a security audit of the modules/vendor.module module and show me the high-risk findingsLimitations
The skills do not replace the Marketplace's own moderation; they are a local pre-submission check. The recon phase is built for Bitrix encodings, including windows-1251, but finding quality depends on the specific module's structure. reports/*.json files are not committed and remain local run artifacts.
How to disable. Delete the skills/bitrix-security folder from your agent install.
FAQ
How is journal-review different from scan?
Scan finds issues and assigns a raw severity, while journal-review re-evaluates it with Bitrix context and real exploitability in mind, keeping the original finding fields.
Can I run the whole process with one command?
Yes, the scan-composer skill is a headless orchestrator with no UI for the whole pipeline.
Discussion
No questions or reviews yet.
Related
All Bitrix24 toolsCodex skills for Bitrix development
Bitrix Agent Skills (Core)
Four Codex skills for Bitrix and Bitrix24 development: project audit and architecture, migrating tables to Grid, FTP deploy and incident triage
A Claude Code and Codex skill for 1C-Bitrix and on-premise Bitrix24 development: check the project core first, then answer
A skill for administering, diagnosing and developing boxed Bitrix24 and Bitrix Framework, built from official documentation
A Bitrix24 REST skill split into capability packs with a method allowlist, risk confirmations and an audit log
39 skills for the Bitrix Framework D7 core: ORM, controllers, caching, REST, security, migrations and more
Bitrix24 app development skill pack
bitrix24-skills-emcsoft
Four skills for Bitrix24 apps: install and OAuth, a batching REST client, events and iframe placements, CRM business processes and calendar
README in short
The Russian README describes the project's five skills: scan, journal-review, journal-update, using-marketplace-sec and scan-composer, and their role in a pre-submission flow. It details the scanner's recon-phase properties: handling Cyrillic and windows-1251, and Bitrix-specific patterns and sinks. It gives run commands for journal-review and journal-update with --validate-only and --previous flags, finding statuses in the cumulative journal, and the skills, reports and tools folder layout with a local UI server.