Skip to the rows

agentsclimarketplace

Error handling security

Skill ShieldNet-360/secure-vibe/dist/claude-skills/.claude/skills/error-handling-security

SecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.

Install

npx -y skills add ShieldNet-360/secure-vibe --skill error-handling-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

No stack traces / SQL / paths / framework versions in client responses; generic errors out, structured errors in logs — Applies to: when generating HTTP / GraphQL / RPC error handlers; when generating exception / panic / rescue blocks; when wiring framework default error pages

SKILL.md

3.2 KB, as published. Nobody here has run it

Error-Handling Security

No stack traces / SQL / paths / framework versions in client responses; generic errors out, structured errors in logs

ALWAYS

Catch exceptions at the boundary (HTTP handler, RPC method, message consumer). Log them with full context server-side; return a sanitized error externally.
External error responses include: a stable error code, a short human-readable message, and a correlation / request ID. They never include: stack trace, SQL fragment, file path, internal hostname, framework version banner.
Log errors at the appropriate level: ERROR / WARN for actionable failures; INFO for expected business outcomes; DEBUG for diagnostic detail (and only when explicitly enabled).
Return uniform error responses across the API surface — same shape, same set of codes — so attackers can't infer behavior from error variation (e.g., login: same message and timing for "wrong username" vs "wrong password").
Disable framework default error pages in production (app.debug = False / Rails.env.production? / Environment=Production / DEBUG=False). Replace with a 5xx page that returns only the correlation ID.
Use a centralized error-rendering helper so the sanitization rules are in one place, not duplicated.

NEVER

Render traceback.format_exc(), e.toString(), printStackTrace(), panic, or framework debug pages to the client in production.
Echo SQL queries / parameters in error messages — IntegrityError: duplicate key value violates unique constraint "users_email_key" tells an attacker the table and column name.
Leak presence-of-record information: User not found vs Invalid password lets an attacker enumerate accounts. Use a single message for both.
Leak filesystem paths (/var/www/app/src/handlers.py) or version banners (X-Powered-By: Express/4.17.1).
Treat try / except: pass as error handling; either the exception is expected (log + continue) or it isn't (let it propagate).
Use 4xx error responses to validate input shape — bots iterate over parameters and use the response body to learn the schema. Return a uniform 400 plus a correlation ID for malformed input.
Send full error details (including PII) to third-party error tracking services without a scrubber. Redact password, Authorization, Cookie, Set-Cookie, token, secret, common PII patterns.

KNOWN FALSE POSITIVES

Developer-facing error pages on localhost / *.local are fine.
A handful of API endpoints (debug, admin, internal RPC) may legitimately return more detail; they must require authenticated, authorized callers and never be reachable from the internet.
Health checks and CI smoke tests intentionally expose details when invoked from inside the cluster.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.