skills.rest
macalbert
macalbertCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

common-security

Enforces security guardrails for secret handling, credential hygiene, and CI/CD workflows in Envilder.

138|5|Updated Sep 19, 2024
Search Tags:#code review#security#input validation#github actions#secrets management#supply chain#oidc
One-click install
npx skills add https://github.com/macalbert/envilder --skill common-security-macalbert
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: common-security
Source: https://github.com/macalbert/envilder/tree/main/.github/skills/common-security
Command: npx skills add https://github.com/macalbert/envilder --skill common-security-macalbert

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams building secret-management tooling risk leaking credentials through logs, hardcoded values, misconfigured CI/CD workflows, or unvalidated inputs. This Skill provides concrete security guardrails for the Envilder project so code reviews and new features consistently follow safe secret-handling practices. ## Core Features & Use Cases - Secret Handling Rules: Defines how secrets are stored, masked, and logged across the CLI, GitHub Action, SDKs, and website, including Secretlint enforcement on every lint run. - CI/CD Credential Hygiene: Mandates OIDC-based AWS authentication, minimal workflow permissions, and SHA-pinned GitHub Actions instead of long-lived access keys. - Input Validation & Supply Chain Safety: Specifies validation rules for CLI options and SDK inputs, dependency pinning via lock files, and a pre-merge security checklist. - Use Case: When reviewing a pull request that adds a new CLI option accepting a file path, apply this Skill to ensure path traversal validation, domain-specific errors, and no unsanitized shell interpolation. ## Quick Start Review this pull request against the common-security guardrails and flag any secret handling, input validation, or workflow permission issues.

Frequently Asked Questions about common-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code for secret handling security?▼

Check that secrets are never logged in plaintext, only via masked values showing the last three characters. Verify secrets live in AWS SSM or Azure Key Vault, never in code, config files, or committed .env files, and confirm Secretlint passes on lint.

How to secure GitHub Actions workflows with AWS credentials?▼

Use aws-actions/configure-aws-credentials with role-to-assume and OIDC instead of storing AWS access keys as GitHub Secrets. Apply minimal permissions blocks, using id-token: write for OIDC and contents: read for checkout, never write-all.

What input validation should a CLI perform on file path options?▼

Validate that map file paths exist, are JSON files, and cannot be used for path traversal. Reject invalid provider names with strict enum matching and raise domain-specific errors like InvalidArgumentError rather than generic exceptions.

Does this security guidance apply to Azure Key Vault as well as AWS SSM?▼

Yes, it covers both providers. AWS SSM requires WithDecryption for SecureString parameters, while Azure Key Vault requires DefaultAzureCredential, vault URL validation against *.vault.azure.net, and TLS validation enabled outside emulator tests.

Why should GitHub Actions be pinned to commit SHAs instead of version tags?▼

Version tags like @v4 can be moved to point at different code, creating a supply chain risk. Pinning to a full commit SHA guarantees the exact action code that runs in production workflows cannot change unexpectedly.

Related Skills

Explore More Software Engineering Skills→
4lerman4lerman

secrets-vault-manager

Manages secret lifecycle, rotation, policies, and audit across Vault and cloud secret stores.

Community
Advanced
hadpadrahulhadpadrahul

gsd-audit-fix

Automate code quality issue detection, classification, and test-verified fixes.

Community
Advanced
Aitronos-DevelopmentAitronos-Development

security-fix

Automate Dependabot alert remediation by upgrading vulnerable dependencies and running tests.

Official
Advanced
seedprodseedprod
93

1password

Set up and operate the 1Password CLI for secure secret management.

Community
Advanced