Skip to content
cccskills
FreePublished on GitHub

security-engineering

Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).

The English summary is being prepared. Showing the original description.

See how to install

Files included (11)

  • SKILL.md4.6 KB
  • references/agentic-ai-security.md1.8 KB
  • references/api-security.md3.4 KB
  • references/asvs-5.md590 B
  • references/cicd-security.md2.7 KB
  • references/code-review-checklist.md1.6 KB
  • references/infrastructure-security.md2.2 KB
  • references/language-specific.md3.2 KB
  • references/owasp-top-10.md908 B
  • references/secure-code-patterns.md1.6 KB
  • references/web3-smart-contracts.md2.6 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Security Engineering

Cross-stack security rules covering API security, infrastructure hardening, Web3 smart contracts, CI/CD review automation, and agentic AI risks. Aligned to OWASP Top 10:2025, ASVS 5.0, and OWASP Agentic Security Initiative 2026.

When reviewing code, think like a senior security researcher: trace user input through to sensitive operations, prefer fail-closed designs, and never trust the client.

Universal Rules

  • Validate every input server-side with Zod (or equivalent) at the API boundary.
  • Parameterize all queries — Prisma/Drizzle, never string concatenation.
  • Authorize on every request — deny by default, verify ownership.
  • Hash passwords with Argon2 or bcrypt — never MD5/SHA1, never plaintext.
  • No hardcoded secrets — env vars validated at startup, secrets in vault, .env in .gitignore.
  • TLS everywhere, encryption at rest on all data stores.
  • Fail-closed on auth/permission errors. Never expose stack traces to users.
  • Log security events with sanitization — redact authorization, cookie, CSRF headers.
  • Least-privilege IAM — scope to specific actions and resource ARNs, not *.
  • OIDC for CI/CD — no long-lived credentials in GitHub.
  • Smart contracts: ReentrancyGuard, SafeERC20, signed data must include chainid + address(this) + deadline, replay-prevention via usedHashes.

References

Related skills

  • web3-smart-contract-engineering — Solidity patterns, signature verification, replay protection (consult alongside references/web3-smart-contracts.md when auditing contracts)
  • deployment-pipelines — pipeline hardening, OIDC, untrusted-input handling in CI
  • godot-engineer — multiplayer games have real security concerns: cheating, save tampering, server-side validation, anti-replay. Pull this in for any networked game.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Use when adversarially reviewing a document that makes formal or technical claims — math derivations, physics papers, statistical analyses, benchmark reports, whitepapers. Inventories every equation and quantitative claim, verifies each AS NAMED in the text (never a paraphrase or a neighboring statement), and classifies VERIFIED / REFUTED / UNVERIFIABLE / VACUOUS. Triggers on "check this paper", "verify these claims", "is this derivation right", "review this proof", "audit this benchmark", "does the math hold up". For source-code review see code-review-and-quality; for skill/agent library audits see skill-library-review; for content quality scoring see content-ops.

The English summary is being prepared. Showing the original description.

LazyIsEfficient/agentic-os17Updated Jul 17, 2026

Run Karpathy-style autoresearch optimization on any content. Generates 50+ variants, scores with a 5-expert simulated panel, evolves winners through multiple rounds, outputs optimized version + full experiment log. Use when optimizing landing pages, email sequences, ad copy, headlines, form pages, CTA text, or any conversion-focused content. Triggers on "optimize this page", "run autoresearch", "score these variants", "A/B test this copy".

The English summary is being prepared. Showing the original description.

LazyIsEfficient/agentic-os17Updated Jul 17, 2026

Tests in real browsers. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data via Chrome DevTools MCP.

The English summary is being prepared. Showing the original description.

LazyIsEfficient/agentic-os17Updated Jul 17, 2026

Conducts multi-axis code review across correctness, readability, architecture, security, and performance. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Triggers on "review my PR", "review this diff", "code review", "review this changeset", "is this ready to merge", "pre-merge review".

The English summary is being prepared. Showing the original description.

LazyIsEfficient/agentic-os17Updated Jul 17, 2026

Estimate the full development cost of an existing codebase from lines of code, architectural complexity, and team-composition overhead. Use for 'how much would this cost to build', 'what did this codebase cost', development-cost or build-cost estimates, calendar-time estimates, and Claude/AI ROI on a delivered codebase. Estimates by measured LOC and complexity, not by ticket volume.

The English summary is being prepared. Showing the original description.

LazyIsEfficient/agentic-os17Updated Jul 17, 2026

Auto-assembles a domain-specific expert panel (7–10 experts), scores any content or strategy artifact against a typed rubric, and iterates until the aggregate hits 90+ (max 3 rounds). Use as a quality gate on copy, email sequences, landing-page drafts, strategy docs, charts, titles, or recruiting evaluations — or when another skill needs a final review gate on its output. Triggers on "expert panel this", "score this", "rate these variants", "quality check this", "panel review", "expert score", "evaluate this copy/strategy/page". For variant generation and multi-round conversion optimization see autoresearch; for live-URL CRO auditing see conversion-ops; for the scripted content-production pipeline see content-pipeline.

The English summary is being prepared. Showing the original description.

LazyIsEfficient/agentic-os17Updated Jul 17, 2026

See all skills by LazyIsEfficient

Report a problem with this skill