SecureCoding
Curated, sanitized export of 21 agent-skill packages for Claude Code and Codex, gated by an automated publication audit (no secrets, no local paths).
npx -y skills add mj-deving/pai-skills --skill SecureCodingAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Proactive secure coding — vulnerability patterns, bypass techniques, defense-in-depth for TypeScript and Cloudflare Workers. USE WHEN secure code, code security, vulnerability prevention, secure coding review, defense in depth, XSS prevention, SQL injection prevention, SSRF prevention, JWT security, access control patterns, API security patterns, secure design, security review code, prototype pollution.
SKILL.md
5.0 KB, as published. Nobody here has run it
SecureCoding
Proactive security guidance adapted from VibeSec-Skill. Bug bounty hunter perspective — teaches attack patterns so you build defenses that actually work.
Customization
Before executing, check for user customizations at:
${PAI_USER_DIR}/SKILLCUSTOMIZATIONS/SecureCoding/
Workflow Routing
| Workflow | Trigger | File |
|---|---|---|
| CodeReview | "security review", "check for vulnerabilities", "secure code review" | Workflows/CodeReview.md |
| SecureDesign | "secure design", "threat model feature", "security architecture" | Workflows/SecureDesign.md |
| SecretAudit | "secret audit", "scan for secrets", "find leaked keys", "git history secrets", "secret discovery" | SecretAudit.md |
Quick Reference
Approach: Bug bounty perspective — think like an attacker, not just a defender Coverage: Access control, client-side, server-side, auth/JWT, API security Focus: TypeScript/Node.js, Cloudflare Workers (framework-specific)
3-Tier Security Decision Framework
Quick triage for any security-relevant code change:
Always Do (no exceptions):
- Validate all external input at system boundary (Zod/schema validation)
- Parameterize database queries (no string concatenation)
- Encode output to prevent XSS
- Hash passwords with bcrypt/scrypt/argon2
- Set security headers (CSP, HSTS, X-Frame-Options)
- Use httpOnly + secure + sameSite cookies for sessions
- Rate limit authentication endpoints
Ask First (requires approval):
- Authentication/authorization logic changes
- New sensitive data storage
- External service integrations
- CORS modifications
- File upload handling
- Permission model changes
Never Do:
- Commit secrets to version control
- Log sensitive data (passwords, tokens, PII)
- Rely on client-side validation for security
- Disable security headers
- Use
eval()with user data - Expose stack traces to users in production
Dependency Auditing
Run periodically and before releases:
npm audit # Check for known vulnerabilities
npm audit --production # Production deps only
Triage by reachability: A critical vulnerability in a dev-only dependency is lower priority than a moderate one in a production request handler. Focus on: (1) Is the vulnerable code path reachable? (2) Can an attacker trigger it? (3) What's the blast radius?
Domain Context Files (loaded on demand):
${CLAUDE_SKILL_DIR}/AccessControl.md— IDOR, privilege escalation, mass assignment, multi-tenant${CLAUDE_SKILL_DIR}/ClientSide.md— XSS, CSRF, open redirects, secret exposure, prototype pollution${CLAUDE_SKILL_DIR}/ServerSide.md— SSRF, file uploads, SQLi, XXE, path traversal${CLAUDE_SKILL_DIR}/AuthSessions.md— JWT attacks, password storage, token management${CLAUDE_SKILL_DIR}/ApiSecurity.md— Mass assignment, GraphQL depth/complexity, introspection${CLAUDE_SKILL_DIR}/BypassTechniques.md— Consolidated bypass catalogs across all domains${CLAUDE_SKILL_DIR}/SecretAudit.md— Secret detection in git history, rotation workflow
Examples
Example 1: Security review of code changes
User: "security review the changes in packages/api"
-> Invokes CodeReview workflow
-> Loads relevant domain context based on code content
-> Returns structured findings with severity, location, fix
Example 2: Secure design for new feature
User: "secure design for the webhook endpoint"
-> Invokes SecureDesign workflow
-> Loads all domain context files
-> Returns attack surfaces, recommended controls
Known Gaps
- Template injection (Handlebars, EJS — not in current stack)
- LDAP injection (no LDAP in PAI projects)
- Insecure deserialization (JSON.parse is safe for JS)
- Business logic flaws (requires human review)
- Compliance frameworks (PCI DSS, HIPAA)
- Infrastructure/network security beyond SSRF
Cross-references:
- Supply chain security →
../SupplyChain.md - Secret auditing →
${CLAUDE_SKILL_DIR}/SecretAudit.md