What problem does it solve? Security scanners can report that code lacks protection against command injection, SQL injection, missing rate limits, token mishandling, hung HTTP requests, disabled TLS verification, eval usage, or hardcoded secrets — but they cannot write the fix. This Skill supplies working, tested reference implementations for each of those findings so the fix is written once, correctly, instead of improvised under deadline. ## Core Features & Use Cases - Injection-safe primitives: shell.mjs runs commands via argument arrays with allow-listed programs (no shell), and sql.mjs is a tagged template producing parameterized { text, values } queries plus allow-listed identifier and ORDER BY helpers. - Abuse and reliability guards: rate-limit.mjs implements a token bucket keyed on verified sessions with a global cost ceiling, and http.mjs provides fetchSafe with owned abort timers, retries, and plaintext refusal. - Credential and eval safety: tokens.mjs enforces httpOnly cookies and a persistence-free in-memory token store, secrets.mjs loads env config with non-enumerable secrets and generates .env.example, and safe-eval.mjs replaces eval with JSON parsing, dispatch tables, and an arithmetic parser. - Use Case: When security-gate blocks a push with sql-interpolation, adapt reference/sql.mjs so user input becomes a bound parameter, then run node reference/self-test.mjs to confirm all 43 assertions pass. ## Quick Start Ask the agent to apply the gate-protections reference implementation for the specific security-gate or system-design-gate rule that fired, then run the self-test to verify the fix.
