Security
Eleven open-source, MIT-licensed skills for AI coding agents — /preflight, /audit, /ship, /remember and more. Plain-Markdown agent guardrails for Claude Code, Codex, Cursor & Hermes. Free layer of SlashStack.
npx -y skills add mverab/slashstack-skills --skill securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- 18 days oldThe repository was created 18 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
- 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use before deploy or sharing to check for beginner-visible security risks.
SKILL.md
1.7 KB, as published. Nobody here has run it
Security
Purpose
Run a beginner-friendly pre-deploy safety review for common security risks.
When to Use
Use before deploy, sharing a repo, adding auth, connecting payments, exposing an API, or asking an agent to make production-facing changes.
Workflow
- Inspect secrets: check for committed
.envfiles, API keys, tokens, credentials, private URLs, and hardcoded secrets. - Check auth assumptions: identify pages, API routes, admin screens, and data mutations that appear to rely on weak or missing auth.
- Review public routes: list routes, endpoints, storage buckets, or files that could be publicly reachable.
- Check risky defaults: flag debug mode, permissive CORS, open redirects, client-side secret usage, broad database rules, or unsafe sample config.
- Explain severity in plain language: High means do not deploy; Medium means fix before real users; Low means track or clean up soon.
- Suggest safe fixes: provide concrete next prompts or commands without applying changes automatically.
- Modo Aprendiz: for EACH security risk, include three sub-fields in
beginner-friendly Spanish:
- Qué significa: what the risk means in plain language.
- Por qué importa: why it matters for the project.
- Qué hacer ahora: one concrete action to take now.
Output
A security review containing:
- High risks: secrets, auth, or public routes that block deploy
- Medium risks: likely unsafe defaults or missing checks
- Low risks: cleanup items
- Modo Aprendiz: each risk includes Qué significa, Por qué importa, and Qué hacer ahora
- Safe next prompt: one scoped prompt to fix the highest-risk item first