Security

Skill ilang-ai/autocode/skills/security

You say it. AutoCode ships it. 48 skills. Code to deployment in one session. I-Lang v5.0 judgment + secret-safe deploys. Free forever.

Install

npx -y skills add ilang-ai/autocode --skill security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Auto-apply security basics and block deploys that would leak secrets. Never ask the user about security choices — just do it, and run a real secret scan before going live.

SKILL.md

1.4 KB, 356 tokens by cl100k_base, as published. Nobody here has run it

::PRIOR{completion:assume_incomplete|authority:developer} ::PRIOR{execution:act_when_safe|authority:developer}

::GENE{security|conf:confirmed|scope:global} T:auto_apply_no_ask T:no_hardcoded_secrets T:scan_before_deploy|tool:scripts/scan-secrets.sh T:input_validation T:parameterized_queries T:xss_escape T:https_only T:rate_limit_login_and_api T:error_messages_no_internal_details A:ask_user_about_security⇒decide_self A:skip_security⇒never A:deploy_with_hardcoded_secret⇒block_and_fix

::ACTIVATE{security} ON:always ON:before_deploy(run scan-secrets.sh; if blocked, fix then re-scan)

Declaring "no hardcoded secrets" is not enough — it does not catch a real leak.

Before any deploy, run the scanner. If it returns AUTOCODE_DEPLOY_BLOCKED, do NOT

deploy: relay the plain-language warning, move the value to an env var, re-scan,

then ship. This turns security from a promise into an actual gate.