Security engineering
Skill LazyIsEfficient/agentic-os/.claude/skills/security-engineering
Agentic Framework for Modern Development
npx -y skills add LazyIsEfficient/agentic-os --skill security-engineeringAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 13 stars13 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).
SKILL.md
4.6 KB, 799 tokens by cl100k_base, as published. Nobody here has run it
Security Engineering
Cross-stack security rules covering API security, infrastructure hardening, Web3 smart contracts, CI/CD review automation, and agentic AI risks. Aligned to OWASP Top 10:2025, ASVS 5.0, and OWASP Agentic Security Initiative 2026.
When reviewing code, think like a senior security researcher: trace user input through to sensitive operations, prefer fail-closed designs, and never trust the client.
Universal Rules
- Validate every input server-side with Zod (or equivalent) at the API boundary.
- Parameterize all queries — Prisma/Drizzle, never string concatenation.
- Authorize on every request — deny by default, verify ownership.
- Hash passwords with Argon2 or bcrypt — never MD5/SHA1, never plaintext.
- No hardcoded secrets — env vars validated at startup, secrets in vault,
.envin.gitignore. - TLS everywhere, encryption at rest on all data stores.
- Fail-closed on auth/permission errors. Never expose stack traces to users.
- Log security events with sanitization — redact
authorization,cookie, CSRF headers. - Least-privilege IAM — scope to specific actions and resource ARNs, not
*. - OIDC for CI/CD — no long-lived credentials in GitHub.
- Smart contracts: ReentrancyGuard, SafeERC20, signed data must include
chainid + address(this) + deadline, replay-prevention viausedHashes.
References
- references/owasp-top-10.md — OWASP Top 10:2025 quick reference table
- references/cicd-security.md — CI/CD security review methodology, scanned vulnerability categories, supply-chain check
- references/api-security.md — auth patterns, Zod validation, rate limiting, CORS, headers, log sanitization, error handling
- references/infrastructure-security.md — VPC isolation, Cloudflare Zero Trust, secrets management, encryption, IAM principles
- references/web3-smart-contracts.md — required patterns, signature verification, on-chain rate limits, audit findings, Slither
- references/code-review-checklist.md — full checklist by category (input, auth, access control, data, errors, Web3)
- references/secure-code-patterns.md — SQLi, command injection, access control, fail-closed, password storage examples
- references/agentic-ai-security.md — OWASP 2026 ASI01-10 + agent security checklist
- references/asvs-5.md — L1/L2/L3 requirements
- references/language-specific.md — JS/TS, Solidity, Python, Go, Bash risks + deep analysis mindset
Related skills
- web3-smart-contract-engineering — Solidity patterns, signature verification, replay protection (consult alongside
references/web3-smart-contracts.mdwhen auditing contracts) - deployment-pipelines — pipeline hardening, OIDC, untrusted-input handling in CI
- godot-engineer — multiplayer games have real security concerns: cheating, save tampering, server-side validation, anti-replay. Pull this in for any networked game.