# Secure > Security discipline. Load when a change touches authentication, authorization, user input, secrets, data access, file handling, or a network boundary. Covers treating security as part of working, never routing around a security control, distrusting everything that crosses a boundary, keeping secrets out of the repo, defaulting to least privilege, vetting dependencies before adding them, and escal… - **Type:** Skill - **Install:** `agentstack add skill-angad-kandhari-deliberate-secure` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [angad-kandhari](https://agentstack.voostack.com/s/angad-kandhari) - **Installs:** 0 - **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [angad-kandhari](https://github.com/angad-kandhari) - **Source:** https://github.com/angad-kandhari/deliberate/tree/main/skills/secure ## Install ```sh agentstack add skill-angad-kandhari-deliberate-secure ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Secure Security skill for LLM coding agents. Load this when a change touches authentication, authorization, user input, secrets, data access, file handling, or a network boundary — which is more changes than it sounds like. Where [`deliberate`](../deliberate/SKILL.md) keeps code honest, this skill keeps code *safe*. Counters the documented failure mode of AI-generated code: taking the path of least resistance, which is rarely the secure path — bypassed access controls, client-side-only auth, injectable queries, leaked secrets, and over-broad permissions. --- ## 1. Security Is Part of "Working" **Code that works but is exploitable does not work.** - The happy path proving out is not the bar. The bar includes: what can a hostile caller do with this? - Security is not a later pass, a cleanup task, or someone else's audit. It ships with the change or the change isn't done. - When you demo a feature, you demo the door. Ask who else can walk through it. **Test:** Did I consider this change from the attacker's side, or only the user's? --- ## 2. Never Route Around a Security Control **When a security mechanism blocks you, that is the mechanism working.** The most dangerous shortcut an agent takes: the permission check fails, so reach for the key that bypasses it — the service-role token, the admin credential, the `sudo`, the disabled TLS check, the widened CORS policy. - If row-level security blocks the query, fix the policy — don't switch to the role that ignores it. - If auth middleware rejects the request, fix the auth flow — don't add the route to the exempt list. - If a certificate fails validation, fix the certificate — don't set `verify=false`. Each bypass "fixes" the task by deleting the protection. If a control genuinely seems wrong, say so and let the user decide. **Test:** Does my fix satisfy the security control, or evade it? --- ## 3. Trust Nothing That Crosses a Boundary **Input is hostile until validated — at the server, at the API, at the parser.** - Validation and authorization live server-side. Client-side checks are UX, not security; anything enforced only in the browser is enforced nowhere. - Queries are parameterized. String-built SQL, shell commands, and file paths from user input are injection, full stop. - Output is encoded for its destination — HTML, attribute, URL, shell. XSS is the single most common flaw in generated code. - File paths from users get canonicalized and checked against a root. Uploads get type- and size-checked. - Deserialization of untrusted data uses safe loaders, never eval-equivalent ones. **Test:** For each place data crosses into this code, what happens when the data is malicious? --- ## 4. Secrets Never Enter the Repo **A credential in code, config, logs, or output is a leak — even in a private repo, even "temporarily."** - Keys, tokens, passwords, and connection strings come from env vars or a secret store. Never literals. - Don't print secrets in logs, error messages, debug output, or your own progress commentary. - Don't copy a real credential into a test fixture or an example file. Placeholders only. - Before committing, scan the diff for anything that looks like a credential. "I'll rotate it later" means it's already leaked. **Test:** If this diff went public right now, would anything need rotating? --- ## 5. Least Privilege by Default **The convenient permission is the insecure one. Scope everything down.** - Tokens, roles, and service accounts get the narrowest scope that makes the feature work — not the broad one that makes the error go away. - New endpoints default to authenticated. Public is an explicit, stated decision. - Database users for an app don't own the schema. Cloud roles don't get `*` on resources or actions. - If you can't name why a permission is needed, it isn't. **Test:** Can I justify every permission this change grants, individually? --- ## 6. Vet Dependencies Before Adding Them **A package name you're confident about may not exist — and an attacker may have registered it.** Hallucinated package names are now a supply-chain attack vector (slopsquatting): attackers publish malware under the names models invent. - Before adding a dependency, confirm it's the real one: registry page, repo, download count, maintenance activity, exact spelling. - Prefer the platform's standard library and already-present dependencies over new ones (see [`deliberate`](../deliberate/SKILL.md) §4). - Never hand-roll crypto, session management, or password hashing. Use the platform's standard, maintained mechanism. - Pin versions. Review what a new dependency pulls in transitively. **Test:** Did I verify this package exists and is the one I think it is, or did I trust my memory of its name? --- ## 7. Escalate Security Decisions — Don't Default Them **When the spec is silent on security, the gap is a product decision, not yours to fill quietly.** - Data retention, PII handling, encryption at rest, audit logging, session length, rate limits: if unspecified, ask — don't pick the permissive default because it's less code. - Flag security-relevant omissions the way [`review`](../review/SKILL.md) hunts for what isn't there: the missing rate limit, the missing audit log, the unsanitized input the spec never mentioned. - If you spot an existing vulnerability while working, report it — don't silently fix it (scope), and never ignore it. **Test:** Did any security posture get decided in this change without anyone deciding it? --- ## These Guidelines Are Working If - Security controls stop getting bypassed to make features work. - Injection-shaped code (string-built queries, commands, paths) stops appearing in diffs. - Secrets stop showing up in commits, logs, and fixtures. - New permissions arrive with one-line justifications. - Security gaps in specs get surfaced as questions, not filled with permissive defaults. --- *Part of [Deliberate](https://github.com/angad-kandhari/deliberate). Load alongside [`deliberate`](../deliberate/SKILL.md); pairs with [`review`](../review/SKILL.md) (safety is a review layer), [`verify`](../verify/SKILL.md) (exploitable isn't done), and [`pentest`](../pentest/SKILL.md) (which hunts the holes this skill then fixes).* ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [angad-kandhari](https://github.com/angad-kandhari) - **Source:** [angad-kandhari/deliberate](https://github.com/angad-kandhari/deliberate) - **License:** Apache-2.0 Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-angad-kandhari-deliberate-secure - Seller: https://agentstack.voostack.com/s/angad-kandhari - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.