Verified:GitHub

security-patterns

Name: security-patterns
Availability: InStock
Author: Hamza-Haadi

Enforces secure coding patterns for secrets, input validation, authentication, and OWASP compliance in Kailash SDK workflows.

Updated Apr 2, 2026

Search Tags:#security #secret management #authentication #input validation #owasp #injection prevention #kailash sdk

Ready to run

npx skills add https://github.com/Hamza-Haadi/disease-risk-classifier-hamza --skill security-patterns-hamza-haadi

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-patterns
Source: https://github.com/Hamza-Haadi/disease-risk-classifier-hamza/tree/main/.claude/skills/18-security-patterns
Command: npx skills add https://github.com/Hamza-Haadi/disease-risk-classifier-hamza --skill security-patterns-hamza-haadi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AI-generated code frequently introduces vulnerabilities like hardcoded credentials, SQL injection, insecure HTTP calls, and unsafe deserialization. This Skill encodes mandatory security patterns and red-team findings so generated Kailash SDK code avoids common vulnerabilities before they reach production. ## Core Features & Use Cases - Secret Management: Enforces environment-variable-based credential handling and prohibits hardcoded API keys, passwords, and tokens. - Injection & Input Validation: Provides parameterized query patterns via DataFlow nodes and safe evaluation with ast.literal_eval instead of eval/exec. - Attack Chain Prevention: Documents critical multi-step exploits found in red teaming (pickle RCE via Redis, auth timing attacks, PACT governance bypass) with concrete prevention code. - Use Case: Before deploying a workflow that calls external APIs and reads user input, apply this Skill's checklist to verify HTTPS usage, validated inputs, no hardcoded secrets, and OWASP Top 10 coverage. ## Quick Start Review my Kailash workflow code for security issues using the security-patterns checklist and fix any hardcoded secrets or injection risks.

Frequently Asked Questions about security-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent hardcoded secrets in Python code?▼

Load credentials from environment variables using os.environ instead of embedding API keys or passwords in source code. For production, store secrets in a secure vault and configure environment variables at deployment time.

How to prevent SQL injection in Kailash SDK workflows?▼

Use DataFlow nodes with parameterized queries instead of string-formatted SQL. DataFlow handles parameterization automatically, so passing validated user input as node parameters prevents injection attacks.

Why is pickle.loads dangerous with Redis data?▼

pickle.loads on data from an attacker-controlled Redis instance executes arbitrary code, enabling remote code execution. Use json.loads with schema validation instead, and validate Redis URL schemes before connecting.

What is a safe alternative to eval() in Python?▼

Use ast.literal_eval, which only evaluates literals like strings, numbers, dicts, and lists. Never expose __import__ in eval or exec globals, as that grants full code execution capability.

How should password verification handle crypto library failures?▼

Fail closed by raising an authentication error when the cryptography library is unavailable, never fall back to plaintext comparison. Use hmac.compare_digest for constant-time hash comparison to prevent timing attacks.