skills.rest
hellowind777
hellowind777COMMUNITY
Explore all skills by this author →
GitHub

hello-security

Enforces secure coding rules for authentication, input validation, and output protection.

702|99|Updated Sep 26, 2025
Search Tags:#encryption#SQL injection#JWT#Security#Authentication#Input Validation#Code review
One-click install
npx skills add https://github.com/hellowind777/helloagents --skill hello-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hello-security
Source: https://github.com/hellowind777/helloagents/tree/main/skills/hello-security
Command: npx skills add https://github.com/hellowind777/helloagents --skill hello-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security-sensitive code often ships with hardcoded secrets, unvalidated inputs, SQL injection risks, and missing token expiration. This Skill gives the AI a concrete security checklist to follow whenever it writes or reviews code involving authentication, credentials, encryption, permissions, or user input.

Core Features & Use Cases

  • Authentication & Secrets Rules: Enforces bcrypt/argon2 password hashing, JWT expiration with RS256/HS256, environment-variable-based API keys, and keeping .env out of version control.
  • Input & Output Protection: Requires whitelist-based input validation, parameterized SQL queries, file upload verification, XSS output encoding with CSP headers, and CSRF token checks.
  • Permission & Delivery Checks: Applies least-privilege and resource-ownership checks, path traversal prevention, and a final delivery checklist covering secrets, validation, and logging of sensitive data.
  • Use Case: When asking the AI to implement a login endpoint with JWT tokens and file upload, the Skill ensures passwords are hashed, tokens expire, uploads are verified, and no secrets are hardcoded.

Quick Start

Ask the AI to implement a user login API with JWT authentication and apply the hello-security rules to the implementation.

Frequently Asked Questions about hello-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely store user passwords in a web application?▼

Store passwords using bcrypt or argon2 hashing so they are irreversible. Never save plaintext passwords, and never log sensitive credential data during authentication flows.

How to implement JWT authentication securely?▼

Set an expiration time on every JWT and sign tokens with RS256 or HS256. Do not place sensitive data in the payload, since JWT payloads are only encoded, not encrypted.

How do I prevent SQL injection in my code?▼

Use parameterized queries for all database access instead of concatenating strings into SQL statements. Validate all external input with a whitelist approach before it reaches the query layer.

Where should API keys and secrets be stored?▼

Keep API keys in environment variables or a dedicated secrets management service, never hardcoded in source code. Add .env files to .gitignore and grant each key only the minimum permissions it needs.

What checks should run before delivering security-sensitive code?▼

Verify there are no hardcoded secrets, all user input is validated, SQL uses parameterized queries, sensitive data stays out of logs, and authentication tokens have expiration times.

Related Skills

Explore More Software Engineering Skills→
TencentBlueKingTencentBlueKing
840

蓝鲸代码安全三大红线

Reviews code against input validation, authentication, and data encryption security rules.

Official
Intermediate
davila7davila7
30.5k

Network 101

Configure and test HTTP, HTTPS, SNMP, and SMB services for penetration testing labs.

Community
Intermediate
gongye19gongye19

code-review

Automate code review to detect style issues, linting violations, and potential bugs.

Community
Intermediate
ntuan2502ntuan2502

security-auditor

Audit code and infrastructure for OWASP Top 10 and compliance vulnerabilities.

Community
Advanced