security
This skill helps you integrate security best practices and OWASP-aligned patterns directly into your codebase, whether you're starting fresh or hardening existing systems. It guides you through vulnerability assessment, secure coding patterns, and compliance-focused implementation strategies to reduce risk and build defensible applications.
The security skill provides guidance on preventing secrets and credentials from being committed to version control through multiple layers: implementing pre-commit security hooks that scan for exposed API keys and tokens before they reach your repository, using environment variables and secrets management tools to keep sensitive data out of code, and setting up automated detection workflows. It covers best practices for .gitignore configuration, credential scanning tools, and CI/CD integration to catch leaks early in your development pipeline.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-14
The security skill provides guidance on preventing secrets and credentials from being committed to version control through multiple layers: implementing pre-commit security hooks that scan for exposed API keys and tokens before they reach your repository, using environment variables and secrets management tools to keep sensitive data out of code, and setting up automated detection workflows. It covers best practices for .gitignore configuration, credential scanning tools, and CI/CD integration to catch leaks early in your development pipeline.
Use it when
- The security skill integrates OWASP-aligned patterns directly into your codebase to help you build defensible applications.
- The security skill helps you establish automated security testing and vulnerability scanning directly in your CI/CD workflows.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
alinaqi/maggy/security · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How can the security skill help me prevent secrets from leaking in git?
The security skill provides guidance on preventing secrets and credentials from being committed to version control through multiple layers: implementing pre-commit security hooks that scan for exposed API keys and tokens before they reach your repository, using environment variables and secrets management tools to keep sensitive data out of code, and setting up automated detection workflows. It covers best practices for .gitignore configuration, credential scanning tools, and CI/CD integration to catch leaks early in your development pipeline.
What OWASP security best practices does this skill cover for web applications?
The security skill integrates OWASP-aligned patterns directly into your codebase to help you build defensible applications. It guides you through implementing input validation and sanitization to prevent injection and XSS attacks, configuring security headers using tools like Helmet, setting up proper authentication with JWT best practices, implementing rate limiting on auth endpoints, and establishing secure CORS configurations. The skill also covers vulnerability assessment strategies and compliance-focused implementation to reduce risk across your application architecture.
How does the security skill help with setting up automated security testing in CI/CD pipelines?
The security skill helps you establish automated security testing and vulnerability scanning directly in your CI/CD workflows. It provides guidance on integrating tools like npm audit for dependency vulnerabilities, setting up GitHub Actions security workflows, implementing pre-commit security hooks, and configuring automated code scanning for security vulnerabilities and anti-patterns. This approach ensures continuous vulnerability detection throughout your development lifecycle and helps catch issues before they reach production.
What input validation and sanitization techniques does the security skill teach?
The security skill teaches you to validate and sanitize user input using industry-standard libraries and patterns to prevent injection and XSS attacks. It covers validation frameworks like Zod and Pydantic for schema validation, sanitization tools like DOMPurify for client-side protection, parameterized queries for SQL injection prevention, and path traversal prevention techniques. The skill provides practical examples for React and other frameworks, helping you implement defense-in-depth input handling across your application.
Can the security skill help me review code for vulnerabilities and anti-patterns?
Yes, the security skill includes guidance on reviewing code for security vulnerabilities and anti-patterns. It helps you identify common security mistakes, understand why certain patterns are risky, and learn defensive alternatives. The skill covers topics like secure password hashing with bcrypt, proper JWT authentication implementation, secure configuration of security headers, and detection of secrets in code. This knowledge enables you to conduct effective security reviews and harden both new and existing systems against common attack vectors.
What does the security skill provide for hardening existing systems?
The security skill guides you through hardening existing systems by integrating OWASP-aligned patterns and vulnerability assessment strategies into your current codebase. It helps you implement security best practices incrementally, set up automated security testing in your existing CI/CD pipelines, add security headers and proper authentication, and establish code review processes focused on security vulnerabilities. The skill provides compliance-focused implementation strategies that reduce risk while working within your existing architecture and development workflow.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Security Skill
Security best practices and automated security testing for all projects.
Core Principle
Security is not optional. Every project must pass security checks before merge. Assume all input is malicious, all secrets will leak if committed, and all dependencies have vulnerabilities.
Required Security Setup
1. Gitignore (Non-Negotiable)
Every project must have these in .gitignore:
# Environment files - NEVER commit
.env
.env.*
!.env.example
# Secrets
*.pem
*.key
*.p12
*.pfx
credentials.json
secrets.json
*-credentials.json
service-account*.json
# IDE and OS
.idea/
.vscode/settings.json
.DS_Store
Thumbs.db
# Dependencies
node_modules/
__pycache__/
*.pyc
.venv/
venv/
# Build outputs
dist/
build/
*.egg-info/
# Logs that might contain sensitive data
*.log
logs/
2. Environment Variables
Create .env.example with all required vars (no
(truncated - see the full file via the links below)
File tree — 1 file
skills/security/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Implement security best practices and OWASP patterns in new or existing projects”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill scans your code for security vulnerabilities and provides actionable remediation guidance. It helps development teams quickly identify and address potential risks before they reach production, streamlining the security review process.
Security Engineer provides a comprehensive framework for implementing authentication and authorization in web applications. Leverage AI-assisted development standards to design secure access controls, manage user credentials, and enforce permission policies across your platform.
This skill helps developers uncover and patch security weaknesses in TypeScript applications. Receive targeted recommendations to harden your codebase against common attack vectors and best-practice violations.
This skill teaches you to recognize and defend against the OWASP Top 10 security vulnerabilities that threaten modern applications. Through practical guidance on threat identification and mitigation strategies, you'll build the defensive coding practices needed to protect your software from common attacks and exploits.
Web Payments provides patterns for adding Stripe to web applications, covering one-time payments, recurring subscriptions, and hosted or embedded checkout experiences. It includes server setup, webhook verification for secure payment confirmation, and client-side integration examples.
Windows Discovery maps privilege escalation vectors on compromised Windows hosts through systematic enumeration of system configuration, user context, services, and misconfigurations. It gathers baseline OS details, token privileges, and group memberships to identify immediate escalation paths, then reports findings to the orchestrator without crossing into exploitation.