agentsclimarketplace

Secure code review

Skill ShieldNet-360/secure-vibe/dist/agent-skills/.agents/skills/secure-code-review

SecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.

Install
npx -y skills add ShieldNet-360/secure-vibe --skill secure-code-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Apply OWASP Top 10 and CWE Top 25 patterns during code generation and review — Applies to: when generating new code; when reviewing pull requests; when refactoring security-sensitive paths (auth, input handling, file I/O); when adding new HTTP handlers or endpoints

SKILL.md

3.0 KB, as published. Nobody here has run it

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/secure-code-review/SKILL.md. -->

Secure Code Review

Apply OWASP Top 10 and CWE Top 25 patterns during code generation and review

ALWAYS

  • Use parameterized queries / prepared statements for all database access. Never build SQL by string concatenation, even for "trusted" inputs.
  • Validate input at the trust boundary — type, length, allowed characters, allowed range — and reject before processing.
  • Encode output for the rendering context (HTML escape for HTML, URL encode for query params, JSON encode for JSON output).
  • Use the language's built-in cryptography library, never custom-rolled crypto. Prefer AES-GCM for symmetric encryption, Ed25519 / RSA-PSS for signatures, Argon2id / bcrypt for password hashing.
  • Use crypto/rand (Go), secrets module (Python), crypto.randomBytes (Node.js), or the platform CSPRNG for any random value involved in security (tokens, IDs, session keys).
  • Set explicit security headers on HTTP responses: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options: nosniff, Referrer-Policy.
  • Use the principle of least privilege for file paths, database users, IAM policies, and process privileges.

NEVER

  • Build SQL/NoSQL queries by string concatenation with user input.
  • Pass user input directly to exec, system, eval, Function(), child_process, subprocess.run(shell=True), or any other command-execution path.
  • Trust client-side validation. Always re-validate server-side.
  • Use MD5 or SHA1 for any new security-sensitive purpose (passwords, signatures, HMAC). Use SHA-256 / SHA-3 / BLAKE2 / Argon2id instead.
  • Use ECB mode for any encryption, ever. Prefer GCM, CCM, or ChaCha20-Poly1305.
  • Use == for password comparison — use a constant-time comparison (hmac.compare_digest, crypto.timingSafeEqual, subtle.ConstantTimeCompare).
  • Allow user input to determine file paths without canonicalization and allowlist checks (defends against ../../../etc/passwd style path traversal).
  • Disable TLS certificate verification in production code — verify=False, InsecureSkipVerify: true, rejectUnauthorized: false.

KNOWN FALSE POSITIVES

  • Internal admin tools intentionally executing shell commands against trusted, fixed arguments are acceptable when documented and code-reviewed.
  • Cryptographic test vectors using MD5 / SHA1 for compatibility with documented protocols (e.g. legacy interop tests) are acceptable.
  • Constant-time comparison is overkill for non-secret comparisons (string equality in logs, tag matching).

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.