Secure Code Changes
Review or implement code changes with security constraints. Use when touching auth, secrets, credentials, permissions, payments, PII, input validation, SQL queries, file uploads, LLM/prompt features, or when the user asks for a security review. Produces a threat-aware checklist, findings, and fixes.
Install
$ agentstack add skill-ariaxhan-the-agent-library-secure-code-changes ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-ariaxhan-the-agent-library-secure-code-changes) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Secure Code Changes
Security is a constraint on the feature, not a cleanup pass later.
1. Identify sensitive surfaces
Look for:
- User input
- Authentication and sessions
- Authorization and ownership
- Secrets and credentials
- Payments or billing
- PII or private data
- File uploads
- Database queries
- Webhook handlers
- LLM prompts and tool calls
State which surfaces are in scope.
2. Check secrets
Search for hardcoded keys, tokens, passwords, and private material. Secrets belong in environment variables, secure stores, or platform secret managers.
Do not print secrets in logs, tests, fixtures, screenshots, or commit messages.
3. Validate inputs
At every boundary:
- Parse with a schema or typed validator.
- Reject invalid input.
- Avoid string concatenation in queries.
- Enforce size limits.
- Treat client-side validation as user experience only, not security.
4. Check auth and authorization
Authentication answers "who are you?" Authorization answers "may you do this?"
Every sensitive read/write needs an ownership or role check. Admin-by-default is a bug.
5. Review common vulnerability paths
Check:
- SQL or command injection
- XSS / unsafe HTML
- CSRF on cookie-auth state changes
- Rate limits on public or expensive endpoints
- Unsafe redirects
- File upload type/size/path handling
- Stack traces or internals in user responses
- Dependency vulnerabilities
- Prompt injection if LLM output controls tools, data, or code paths
6. Fail secure
On uncertain state, deny access or stop the operation. Errors should not grant permissions, skip checks, or continue with partial security context.
7. Produce findings or fixes
For each issue:
- Severity
- Attack path
- Affected file/endpoint
- Evidence
- Fix
- Test or check
For high-risk areas, require human review even if automated checks pass.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ariaxhan
- Source: ariaxhan/the-agent-library
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.