Security
Curated Agent Skills marketplace for Claude Code, Codex, and Google Antigravity.
npx -y skills add Jylhis/skills --skill securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use for code security review and safe alternatives across language ecosystems — Python (subprocess command injection, pickle / yaml.load deserialization, SSRF, SQL injection, path traversal, secrets, bcrypt/argon2, cryptography, TLS verify); TypeScript / Node (child_process exec/shell, prototype pollution, XSS via DOMPurify, SSRF, secrets handling, Zod validation, npm audit, Helmet, CSP); JVM (JNDI / Log4Shell, Java serialization, XXE, SSRF, SQL injection, secrets, crypto APIs). Read the matching reference before reviewing untrusted-input handlers.
SKILL.md
1.8 KB, as published. Nobody here has run it
Security skill index
Pick the topic and read its reference before auditing or writing any code that handles untrusted input or external services.
| Stack | When to read | Reference |
|---|---|---|
| Python | subprocess command injection, pickle / yaml.load, SSRF, SQL injection, path traversal, secrets, bcrypt / argon2, cryptography, TLS verify | references/python.md |
| TypeScript / Node | child_process exec, prototype pollution, XSS, SSRF, secrets, Zod validation, npm audit, Helmet, CSP / HSTS | references/typescript.md |
| JVM (Java / Kotlin) | JNDI / Log4Shell-class, Java serialization, XXE, SSRF, SQL injection, secrets, crypto APIs | references/jvm.md |
Common rules across all stacks:
- Validate untrusted input at system boundaries (HTTP handlers, message queues, file uploads, env-var parsers).
- Never pass untrusted strings to a shell — use argv-array forms
(
subprocess.run([...]),child_process.execFile(...)). - Block private / metadata IP ranges (e.g.
169.254.169.254) on any outbound HTTP that takes a user-supplied URL. - Treat secrets as inputs from a secret manager; never commit
.envor hard-code credentials.
After reading the reference, follow its guidance for the task.