agentsclimarketplace

Protocol security

Skill ShieldNet-360/secure-vibe/dist/claude-skills/.claude/skills/protocol-security

SecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.

Install
npx -y skills add ShieldNet-360/secure-vibe --skill protocol-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

TLS 1.2+, mTLS, certificate validation, HSTS, gRPC channel credentials, WebSocket origin checks — Applies to: when generating HTTP / gRPC / WebSocket / SMTP / database clients & servers; when generating TLS configuration in code or platform config; when generating service-to-service auth

SKILL.md

3.4 KB, 719 tokens by cl100k_base, as published. Nobody here has run it

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/protocol-security/SKILL.md. -->

Protocol Security

TLS 1.2+, mTLS, certificate validation, HSTS, gRPC channel credentials, WebSocket origin checks

ALWAYS

  • Default to TLS 1.3 for new clients and servers; permit TLS 1.2 only for interop with legacy peers. Disable TLS 1.0/1.1, SSLv2/v3.
  • Validate the server certificate: chain to a trusted CA, name matches the expected hostname (or SAN), not expired, not revoked (OCSP stapling enabled).
  • Enable HSTS on HTTP responses for everything served over HTTPS: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. Add the host to the HSTS preload list once stable.
  • Use mutual TLS (mTLS) for service-to-service traffic inside a trust domain (mesh: Istio / Linkerd; standalone: SPIFFE / SPIRE for identity).
  • For gRPC clients/servers, use grpc.secure_channel / grpc.SslCredentials / credentials.NewTLS — never insecure_channel in production.
  • For WebSocket servers, validate the Origin header against an allowlist and authenticate the handshake (cookies + CSRF token, or a query-string bearer used once at upgrade and re-validated).
  • For service-to-service tokens, prefer SPIFFE IDs (spiffe://trust-domain/...) with short-lived workload certs over long-lived API keys.
  • Pin the certificate (public key pinning) for high-risk mobile / desktop clients calling back to the operator's own backend.

NEVER

  • Disable certificate verification (InsecureSkipVerify: true, verify=False, rejectUnauthorized: false, CURLOPT_SSL_VERIFYPEER=0). The only acceptable use is in a unit test that runs against a localhost ephemeral cert.
  • Implement a custom X509TrustManager / HostnameVerifier / URLSessionDelegate / ServerCertificateValidationCallback that unconditionally returns trusted.
  • Mix HTTP and HTTPS resources on the same page (mixed content) — modern browsers will block subresources, but APIs are still vulnerable to MITM downgrade.
  • Send tokens / passwords over plain HTTP — even on localhost in dev unless the dev environment is documented as not security-relevant.
  • Use grpc.insecure_channel(...) in production code.
  • Trust the Host / X-Forwarded-Host / Forwarded header without an allowlist; absolute URLs built from Host enable host-header injection and password-reset poisoning.
  • Forward incoming Authorization / Cookie headers blindly across origins in your service mesh — re-derive identity from mTLS or a service token.
  • Enable TLS renegotiation on clients you control; pin to tls.NoRenegotiation where available.

KNOWN FALSE POSITIVES

  • Localhost-only dev servers with self-signed certs and explicit documentation are fine; CI tests against ephemeral CA-signed certs are fine.
  • A small number of legacy enterprise integrations require TLS 1.2 with a specific cipher; document the exception and isolate the integration behind a proxy.
  • Public read-only endpoints (e.g., status pages) can legitimately serve over HTTP for cacheability, though HTTPS is still preferred.

What ships with it: 1 file

954 B alongside SKILL.md

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.