sec-unit

Apply a five-point security checklist to external outputs before constructing Bash commands.

Updated Aug 27, 2026
One-click install
npx skills add https://github.com/aldengolab/lorist --skill sec-unit
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: sec-unit
Source: https://github.com/aldengolab/lorist/tree/main/skills/sec-unit
Command: npx skills add https://github.com/aldengolab/lorist --skill sec-unit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

A five-point security checklist helps ensure you don't construct dangerous Bash commands when results come from kubectl, argocd, helm, WebFetch, or git log. It prevents prompt-injection, data leakage, and misconstructed pipelines by requiring explicit authorization before actions.

Core Features & Use Cases

  • Applies the sec-unit checklist automatically to external outputs before command construction.
  • Detects common risk vectors like instruction-in-data positions, URL-path substitutions, multi-step exfiltration risk, and inline executions.
  • Works as a gating layer for Claude Code workflows, ensuring safe automation of infrastructure tasks.

Quick Start

Ask sec-unit to run the five-point security checklist immediately after receiving external output and before composing any Bash command.

Frequently Asked Questions about sec-unit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent prompt injection when building Bash commands from kubectl output?

Preventing prompt injection from kubectl output requires screening external results with a five-point security checklist before any Bash command is built. This process detects instruction-in-data positions and halts execution on flagged conditions, requiring explicit user authorization to proceed.

What is data exfiltration risk in multi-step pipelines using helm or argocd?

Data exfiltration risk in multi-step pipelines occurs when external outputs from tools like helm or argocd contain malicious URL-path substitutions that covertly transmit sensitive data. Detecting this risk involves checking outputs against a security checklist before authorizing downstream command execution.

How to secure git log output before using it in automated Bash scripts?

Securing git log output involves running the external output through a five-point security checklist before constructing Bash commands. This identifies potential data injections and inline execution risks, halting the pipeline to require explicit authorization before any action proceeds.

Does Claude Code work with a security gating layer for WebFetch command construction?

Claude Code works with a security gating layer by applying a checklist to WebFetch outputs before Bash command construction. This layer prevents misconstructed pipelines and data leakage by requiring explicit user authorization before proceeding with any flagged automated infrastructure tasks.

When should I halt command execution to prevent unsafe Bash command construction?

You should halt command execution to prevent unsafe Bash command construction whenever a five-point security checklist flags conditions like instruction-in-data positions, URL-path exfiltration risks, or inline executions in external outputs. The process requires explicit user authorization before proceeding.