Individual skill
secure-coding
Use when securing application code: threat-modeling a feature, security-reviewing a diff, hardening auth/authz, secrets, CORS/CSP, or fixing OWASP-class bugs (access control, injection, SSRF, supply chain) in FastAPI, Next.js, Go or Flutter. NOT running the scanners (that is security-scan), NOT agent prompt-injection guardrails (that is agent-safety).
skills/secure-coding/SKILL.md
Source commit d9d6bb338f66cc1e23998585e580a0ea45bbcb82
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 540
- Repository last updated
- Nov 4, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- agentic-ai Repository topic
- ai-agents Repository topic
- ai-coding Repository topic
- claude-code Repository topic
- cli Repository topic
- cline Repository topic
- codex Repository topic
- coding-assistant Repository topic
- cursor Repository topic
- security Declared skill tag
- owasp Declared skill tag
- stride Declared skill tag
- auth Declared skill tag
- review Declared skill tag
- security Derived category
- engineering Derived category
- operations Derived category
- security-application Derived category
- engineering-web Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 17,936 bytesSKILL.mdcore · 17,936 bytesSKILL.mdcore · 17,936 bytesSKILL.mdcore · 17,936 bytesSKILL.mdcore · 17,936 bytesSKILL.mdcore · 17,936 bytesSKILL.mdcore · 17,936 bytesevals/README.mddoc · 2,780 bytesevals/cases.yamlasset · 6,026 bytesreferences/authn-authz.mddoc · 9,572 bytesreferences/owasp-by-stack.mddoc · 22,737 bytesreferences/secrets-and-supply-chain.mddoc · 8,663 bytesreferences/threat-modeling.mddoc · 10,236 bytesscripts/verify.shruns · 9,646 bytes
Read excerpt
# Secure coding — threat modeling + OWASP across the stack
Threat-model a feature in PR-sized increments, fix OWASP-class bugs with
stack-correct vulnerable→fixed diffs, and gate the result with `verify.sh`.
Stacks: FastAPI/Python 3.12+, Next.js 15 / React 19 / TS, Go 1.22+,
Flutter/Dart 3, PostgreSQL 16.
Operating posture:
- **Read-only by default.** Identify → rank by exploitability → propose fixes
as diffs. Apply changes only when the user asks.
- **Exploitability over theory.** Rank like a bounty triager: reachable +
user-controlled + meaningful sink comes first. Do not dump a flat checklist.
- **Every finding ships a fix.** Never "consider sanitizing" — show the