agentsclimarketplace
Sign in

Eng security safety

Skill tjboudreaux/cc-engineering-skills/skills/eng-security-safety

Apply proactive threat modeling, least-privilege design, and safety guardrails before delivering any code or infrastructure change.From its SKILL.md

Install
npx -y skills add tjboudreaux/cc-engineering-skills --skill eng-security-safety

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.0 KB, as published. Nobody here has run it

Security and Safety Mindset

Intent

  • Treat every change as a potential attack surface or failure amplifier.
  • Ensure data classification, secret handling, and permission scopes stay compliant.
  • Bake safety checks (rate limits, input validation, monitoring) into the design, not after.

Baseline Checklist

  1. Threat model quickly: Who could abuse this surface? What capabilities do they need? What happens if they succeed?
  2. Data stewardship: Classify data touched (PII, payments, assets) and enforce encryption, retention, and locality rules.
  3. Access + identity: Validate authn/authz paths, key rotation, wallet signatures, and privilege escalation barriers.
  4. Dependency hygiene: Pin versions, verify licenses, review changelogs, and prefer audited libraries/contracts.
  5. Secrets + config: Never log secrets; store them in the project’s approved secret manager. Guard env var usage.

Workflow

  1. Enumerate entry points (mobile UI, API, smart contract, admin tools) and list unchecked inputs.
  2. Define validation layers: schema-level, business-level, and environment-level (e.g., chain ID, platform version).
  3. Ensure every state change is reversible or compensatable (feature flags, contract pausing, migration guards).
  4. Instrument detection: structured logs, metrics, or on-chain events that can surface abuse or regressions fast.
  5. Document explicit “never do” actions (e.g., disable signature checks, bypass paywalls) inside the PR/issue notes.

Verification

  • Run the project’s security/static analysis tooling (linters, contract analyzers, mobile scanners) and fix findings.
  • Peer review the threat model summary; confirm secrets and keys are absent from diffs/logs.
  • Validate abuse cases end-to-end (invalid payloads, replayed signatures, abusive traffic) before shipping.

Keep looking

Skills are one crate of 627,801. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.