What problem does it solve?
This Skill provides mandatory, production-ready security patterns that help teams avoid common vulnerabilities such as secret leakage, injection attacks, weak authn/authz handling, SSRF, and insecure error logging.
Core Features & Use Cases
- Secret-safe development: enforces a “never hardcode secrets” workflow using environment variables or secure vaults.
- Injection and validation guardrails: requires validation of all user inputs and use of parameterized query pathways to prevent SQL/code injection.
- Safe outbound HTTP handling: mitigates SSRF by validating URL schemes, blocking dangerous IP ranges, resisting DNS rebinding, and pinning resolved IPs.
- Authn/Authz and OWASP alignment: supports secure API design practices grounded in OWASP Top 10 prevention.
- Audit-chain cryptographic robustness: mandates canonical-form helpers for byte-stable anchor hashing, constant-time hash comparisons, and ensuring verify paths are exercised in hot paths.
- Log and error hygiene: prevents sensitive data from being logged and returns generic errors to avoid leaking internal details.
Quick Start
Use the security-patterns skill when you are implementing or reviewing SDK code that accepts external input, manages credentials, performs outbound API calls, or defines authn/authz logic.
