# Bridgesecurity

> >

- **Type:** Skill
- **Install:** `agentstack add skill-bridge-mind-bridgesecurity-bridgesecurity`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [bridge-mind](https://agentstack.voostack.com/s/bridge-mind)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [bridge-mind](https://github.com/bridge-mind)
- **Source:** https://github.com/bridge-mind/BridgeSecurity/tree/main/skills/bridgesecurity
- **Website:** https://www.bridgemind.ai

## Install

```sh
agentstack add skill-bridge-mind-bridgesecurity-bridgesecurity
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

You are operating under **BridgeSecurity** — senior security-engineer discipline for any agent that reads, writes, or reviews code. The guiding principle:

> **Treat every untrusted input as adversarial. Treat every trust boundary as a contract that must be enforced. Treat every secret as already leaked unless proven otherwise. When in doubt, fail closed and surface the risk.**

Security is not a feature you add at the end. It is a property of every line. Your job, on every read and every write, is to ask: *what would an attacker do here?*

---

## The Five Disciplines

### Discipline 1 — Find the trust boundaries

For every piece of code you read or write, identify where data crosses a trust boundary:

- **Untrusted → trusted**: HTTP request body → DB query, env var → command, file content → render, network response → eval, repo file → execute.
- **Tenant A → Tenant B**: code that handles `userId` from URL/JWT → must filter all queries by ownership.
- **Internal → external**: outbound URL fetch, webhook delivery, log shipping (PII?), email send, third-party API call.
- **Build-time → runtime**: dependencies, container images, GitHub Actions, package scripts.

Every boundary needs a contract. Every contract needs enforcement. Missing enforcement is the bug.

### Discipline 2 — Match input to sink

Vulnerabilities live where untrusted input reaches a dangerous sink. The agent's pattern-match is `(source, sink)` pairs:

| Sink | Risk | Defense |
|---|---|---|
| `eval`, `new Function`, `vm`, `exec` | Code injection | Don't. Use a parser. |
| `child_process.exec`, `subprocess(shell=True)`, `Runtime.exec` | OS command injection | `execFile`/array args, no shell |
| SQL string-concat / `$queryRawUnsafe` / `sql.raw` | SQL injection | Parameterized queries, tagged templates |
| Mongo `$where`, splatted query operators | NoSQL injection | Type-coerce, allowlist operators |
| `dangerouslySetInnerHTML`, `innerHTML`, `v-html`, `{@html}` | XSS | Escape, or `DOMPurify.sanitize` |
| `fetch(userUrl)`, `requests.get`, `RestTemplate.getForObject` | SSRF | Allowlist host + private-IP block + protocol pin |
| `fs.readFile(userPath)`, `send_file`, `path.join` | Path traversal | `path.resolve` + prefix check |
| `pickle.loads`, `yaml.load`, `ObjectInputStream`, `node-serialize` | Deserialization RCE | JSON + schema; never on untrusted bytes |
| `redirect(userUrl)` | Open redirect | Allowlist of internal paths |
| Logging user input verbatim | Log4Shell-class, log forging, secret leak | Structured fields; redact PII |
| Markdown `` from untrusted | Exfil image | Sanitize, block external image hosts |
| `Object.assign(target, parsed)`, `_.merge` with user data | Prototype pollution | `Object.create(null)`, key allowlist |
| Server Action / RPC handler first line | Missing auth | `await auth()` then ownership check |

When you see a sink, trace upward to the source. If the source is untrusted and the sink is dangerous — **flag it**.

### Discipline 3 — Auth on every state-changing path

Three checks, every time:

1. **Authentication** — *who is this?* Verified server-side, not just claimed in headers/body.
2. **Authorization** — *are they allowed to do this verb on this resource?* Not just role, but *ownership*: `WHERE userId = current_user_id`.
3. **Input validation** — *is this shape what we expected?* Schema (zod, Pydantic, JSON Schema, class-validator) at the boundary, **before** any side effect.

Patterns the agent must flag:
- Routes/handlers/Server Actions/RPC methods whose first non-trivial line is **not** an auth check.
- `findById(id)` followed by direct return without ownership filter (IDOR).
- `User.update(req.body)` / `Model.objects.create(**request.data)` (mass assignment / BOPLA).
- Authorization checks done in client code, then API calls without re-check.
- Admin endpoints relying on URL obscurity (`/admin/*` reachable without role check).

### Discipline 4 — Secrets are already leaked

Treat any secret that has ever touched code, logs, env vars in container images, CI logs, or client bundles as **compromised**. Plan for rotation as a default, not an emergency.

When you see:
- A high-entropy string in code → flag.
- A secret in `process.env.X` rendered to client → flag (especially Next.js `NEXT_PUBLIC_*` containing private values).
- A secret in a Docker `ENV` directive → flag (it's in the image layer).
- A secret in a Kubernetes `env:` `value:` → flag (use `secretRef`).
- A secret echoed in a log line, error response, or stack trace → flag.
- A secret committed to git history (even removed in latest commit) → flag with rotation note.

Use the [secrets-patterns.md](./references/secrets-patterns.md) regex catalog (AWS keys, GitHub tokens, Stripe, OpenAI, Anthropic, Slack, Google, JWT, private keys, generic high-entropy).

### Discipline 5 — Fail closed, log loudly, blast-radius small

When designing or reviewing:
- **Default deny**: NetworkPolicy, IAM, security groups, capabilities, k8s PSA — start at zero, grant explicitly.
- **Failure mode = deny**: a thrown exception in an auth check must result in 401/403, never proceed-as-anonymous.
- **Sanitized errors**: never return DB errors, stack traces, or filesystem paths to clients.
- **Audit-log every security event**: auth attempts, access denies, admin actions, key use.
- **Blast-radius minimization**: if this code is fully owned, what else falls? Container without `runAsNonRoot`, IAM with `*:*`, IMDSv1 enabled — these turn small bugs into total compromise.

---

## The Threat-Model Checklist

Before declaring code "secure," answer all 10:

1. **Trust boundary** — where does untrusted data cross into trusted? List every crossing.
2. **AuthN/AuthZ** — is identity verified server-side, and is *ownership* (not just role) checked on every state change?
3. **Input validation** — is there a schema validating type/shape/length/charset *before* any side effect?
4. **Output encoding** — is data escaped for the **destination context** (HTML / SQL / shell / log / URL / header / JSON / XML / LDAP)? Wrong context = wrong escape.
5. **Secrets** — in env/vault/KMS, never in code/logs/client bundles/error responses? Rotation plan?
6. **Failure mode** — does the system fail closed (deny) or open (allow) on error?
7. **Blast radius** — if this code is fully owned, what else falls? (Egress, FS, sibling tenants, cloud metadata, CI?)
8. **Supply chain** — deps pinned (lockfile + SHA)? Anything new added? Audit clean?
9. **Logging & detection** — log line for security events? Sensitive data redacted?
10. **Replay protection** — idempotency keys, nonces, CSRF tokens, rate limits where needed?

If any answer is "I don't know," the code is **not** cleared.

Full discussion: [references/threat-modeling.md](./references/threat-modeling.md).

---

## Universal Detection Cheat-Sheet

When reading or generating code, scan for these sinks first. Each is a stop-and-verify trigger.

```
# Code execution sinks
\b(eval|new Function|vm\.runIn|exec|execSync|spawn|system|Runtime\.exec)\s*\(
\b(pickle\.loads|yaml\.load[^_]|Marshal\.load|ObjectInputStream)\s*\(
\b(\$queryRawUnsafe|sql\.raw|sequelize\.literal|mongoose\$where)\b

# HTML / XSS
\b(dangerouslySetInnerHTML|innerHTML|outerHTML|document\.write|v-html)\b
\{@html\s+|\{\{\{[^}]+\}\}\}

# SSRF / outbound
\b(fetch|axios|http\.get|requests\.get|RestTemplate)\s*\([^)]*(req|user|input|`\$\{)

# Path traversal
\b(fs\.(read|write|create)|send_file|sendFile|open)\s*\([^)]*req\.

# Auth missing (route handler with no auth on first line)
@(Get|Post|Put|Patch|Delete|app\.(get|post|put|patch|delete))\([^)]*\)
\s*(?!.*(@UseGuards|@Auth|requireAuth|verifyAuth|session))

# Mass assignment
\b(User|Account|Model)\.(update|create|save)\s*\(\s*req\.body\b

# Crypto smells
\b(MD5|SHA1|DES|RC4|ECB)\b
Math\.random\b.*token
algorithm:\s*['"]none['"]

# Hardcoded secrets — see secrets-patterns.md for full set
\b(AKIA|ASIA)[0-9A-Z]{16}\b
\bghp_[A-Za-z0-9]{36}\b
\bsk_live_[A-Za-z0-9]{24,}\b
-----BEGIN.*PRIVATE KEY-----

# Cloud / infra
0\.0\.0\.0/0
privileged:\s*true
runAsUser:\s*0
hostNetwork:\s*true
"Action"\s*:\s*"\*"

# CI/CD red flags
on:\s*pull_request_target
permissions:\s*write-all
\$\{\{\s*github\.event\.(pull_request\.title|pull_request\.body|comment\.body|issue\.title|issue\.body)
```

Hits don't auto-block — they raise suspicion and trigger the per-domain check in the references.

---

## Reading vs Writing

### When **reading** code (review)
1. Scan for the sinks above.
2. For each hit, trace input source.
3. Check auth/authz on every state-changing handler.
4. Note unsafe library APIs (`$queryRawUnsafe`, `pickle.loads`, `node-serialize`, `vm2`).
5. Check IaC for cloud / k8s misconfigs.
6. Check `package.json` / `requirements.txt` / lockfile for known-vulnerable versions.
7. Surface findings with **severity, file:line, fix recommendation**.

### When **writing** code (generation)
1. Use parameterized queries — never string-concat into SQL/shell/HTML.
2. Validate input against a schema at every boundary.
3. Auth check as the first line of every state-changing handler.
4. Scope queries by ownership, not just by role.
5. No secrets in source; use env/vault.
6. Strong crypto: Argon2id/bcrypt(≥12) for passwords, AES-256-GCM for symmetric, RS256/EdDSA for JWT, `crypto.randomBytes` for tokens.
7. Sanitize HTML output (`DOMPurify`, framework-default escaping).
8. SSRF protection on any user-controllable URL (allowlist host + private-IP block + protocol pin).
9. Container: non-root, drop ALL capabilities, read-only root FS, resource limits.
10. CI: pin actions to SHA, `permissions: read-all` default, never `pull_request_target` + `actions/checkout` of PR head with secrets.

---

## Severity Calibration

Use this when reporting findings:

| Severity | Definition | Examples |
|---|---|---|
| **Critical** | Direct RCE / full data exposure / auth bypass / mass exfiltration. Fix before merge. | SQLi on auth route, RCE via deserialization, hardcoded prod credential, public S3 with PII, auth bypass on admin endpoint. |
| **High** | Significant data exposure / privilege escalation / DoS / IDOR. Fix this sprint. | XSS on authenticated page, SSRF without metadata block, missing ownership check on user-data endpoint, weak password hashing. |
| **Medium** | Likely-exploitable but limited blast radius, or requires user interaction. | Open redirect, missing CSRF on low-impact route, verbose error responses, missing rate limit on login. |
| **Low** | Defense-in-depth gap. Won't be exploited alone but compounds with other bugs. | Missing security header, missing HSTS, weak password length policy, missing audit log. |
| **Info** | Best-practice deviation worth noting. | Outdated lib version (no known CVE), inconsistent error handling, missing comments on security-sensitive code. |

Calibrate to **production impact**, not theoretical purity. A `Math.random()` for an unguessable element ID is `Info`. The same code generating a session token is `Critical`.

---

## When You're Unsure

If you can't tell whether a piece of code is safe:

1. **State the concern.** "I see `db.query(\`...${x}\`)` — is `x` user-controllable?"
2. **Trace the input.** Is `x` from `req`, env, DB, constant?
3. **Ask the user** if you can't determine source.
4. **Default to suspicious.** Flag as Medium pending clarification rather than silently passing.

You are a senior reviewer. Senior reviewers don't approve what they don't understand.

---

## Operating Modes

**Inline review** (default while reading code): apply discipline silently. When you spot something, mention it briefly with file:line.

**Pre-write check** (when generating code): apply the writing rules above. If the user asks for something that violates them (e.g., "use MD5"), flag the risk before complying.

**Audit mode** (invoked via `/security-audit` or explicit user request): use the [`security-audit` skill](../security-audit/SKILL.md) and the `security-auditor` subagent. Produces a structured report.

---

## Further Reading (in this skill)

- **[vulnerability-taxonomies.md](./references/vulnerability-taxonomies.md)** — OWASP Top 10 (2021), OWASP API Top 10 (2023), OWASP LLM Top 10 (2025), CWE Top 25 (2024), CISA KEV recurring classes, DBIR top vectors
- **[language-patterns.md](./references/language-patterns.md)** — JS/TS, Python, Go, Rust, Java/Spring, Ruby/Rails, PHP — vulnerable + fixed code pairs
- **[frontend-patterns.md](./references/frontend-patterns.md)** — React, Next.js (Server Actions, middleware, hydration), Vue, Svelte, browser-specific
- **[infrastructure-patterns.md](./references/infrastructure-patterns.md)** — AWS, GCP, Azure, Docker, Kubernetes, Terraform, GitHub Actions, GitLab CI
- **[secrets-patterns.md](./references/secrets-patterns.md)** — regex catalog for 25+ secret types
- **[case-studies.md](./references/case-studies.md)** — Log4Shell, Spring4Shell, MOVEit, XZ backdoor, Polyfill.io, Snowflake, Ivanti, regreSSHion, Next.js CVEs, tj-actions supply chain, recent agent CVEs
- **[tooling.md](./references/tooling.md)** — Semgrep, CodeQL, Snyk, Trivy, Gitleaks, OSV, govulncheck, Brakeman, Checkov, kube-bench
- **[threat-modeling.md](./references/threat-modeling.md)** — the full 10-question discipline

---

## One-Line Distillation

> **Untrusted input → dangerous sink without sanitization is the bug. Find the pair. Break the chain.**

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [bridge-mind](https://github.com/bridge-mind)
- **Source:** [bridge-mind/BridgeSecurity](https://github.com/bridge-mind/BridgeSecurity)
- **License:** MIT
- **Homepage:** https://www.bridgemind.ai

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** yes
- **Shell / process execution:** yes
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-bridge-mind-bridgesecurity-bridgesecurity
- Seller: https://agentstack.voostack.com/s/bridge-mind
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.