security

Enforce OWASP security patterns and automated security testing in CI/CD pipelines.

Updated Apr 21, 2026

Search Tags:#security #owasp #secrets-management #security-testing #ci-cd-security #environment-validation

Ready to run

npx skills add https://github.com/joshuakessell/cornerstone --skill security-joshuakessell

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security
Source: https://github.com/joshuakessell/cornerstone/tree/main/.claude/skills/security
Command: npx skills add https://github.com/joshuakessell/cornerstone --skill security-joshuakessell

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security best practices and automated security testing for all projects.

Core Features & Use Cases

OWASP security patterns, secrets management, and automated security testing to reduce risk across codebases.
Setup guidance including environment variable validation, .gitignore hygiene, and CI/CD security workflows to catch issues early.
Use Case: Ensure no secrets are committed, run dependency audits, and enforce input validation across services.

Quick Start

Set up the repository by applying the .gitignore rules, creating .env.example, and wiring pre-commit and CI security checks as described.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent secrets from being committed to my Git repository?▼

Preventing secrets from being committed requires enforcing .gitignore hygiene, creating .env.example files, and wiring pre-commit hooks for secrets scanning. This approach safeguards environment variables and catches sensitive data exposure early in development.

What is the best way to automate security testing in a CI/CD pipeline?▼

Automating security testing in a CI/CD pipeline is best achieved by configuring GitHub Actions workflows for secrets scanning, dependency auditing, and CodeQL analysis. This integration catches vulnerabilities and enforces secure coding practices during deployment.

How do I apply OWASP security patterns for input validation?▼

Applying OWASP security patterns for input validation involves enforcing environment variable validation and specific coding practices across software projects. This reduces risk across codebases by ensuring services properly validate inputs before processing.

Does this security testing approach work with GitHub Actions?▼

Yes, this security testing approach works directly with GitHub Actions by wiring CI security workflows for secrets scanning, dependency auditing, and CodeQL analysis. It integrates seamlessly into existing pipelines to harden deployments and audit dependencies.

Why do I need pre-commit hooks for secrets management?▼

Pre-commit hooks for secrets management are needed to catch issues early before code reaches the repository. They automate environment variable validation and secrets scanning locally, preventing sensitive data from being committed and reducing codebase risk.