Security
Use before deploy or sharing to check for beginner-visible security risks.
Install
$ agentstack add skill-mverab-slashstack-skills-security ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-mverab-slashstack-skills-security) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Security
Purpose
Run a beginner-friendly pre-deploy safety review for common security risks.
When to Use
Use before deploy, sharing a repo, adding auth, connecting payments, exposing an API, or asking an agent to make production-facing changes.
Workflow
- Inspect secrets: check for committed
.envfiles, API keys, tokens,
credentials, private URLs, and hardcoded secrets.
- Check auth assumptions: identify pages, API routes, admin screens, and data
mutations that appear to rely on weak or missing auth.
- Review public routes: list routes, endpoints, storage buckets, or files that
could be publicly reachable.
- Check risky defaults: flag debug mode, permissive CORS, open redirects,
client-side secret usage, broad database rules, or unsafe sample config.
- Explain severity in plain language: High means do not deploy; Medium means
fix before real users; Low means track or clean up soon.
- Suggest safe fixes: provide concrete next prompts or commands without
applying changes automatically.
- Modo Aprendiz: for EACH security risk, include three sub-fields in
beginner-friendly Spanish:
- Qué significa: what the risk means in plain language.
- Por qué importa: why it matters for the project.
- Qué hacer ahora: one concrete action to take now.
Output
A security review containing:
- High risks: secrets, auth, or public routes that block deploy
- Medium risks: likely unsafe defaults or missing checks
- Low risks: cleanup items
- Modo Aprendiz: each risk includes Qué significa, Por qué importa, and Qué hacer ahora
- Safe next prompt: one scoped prompt to fix the highest-risk item first
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: mverab
- Source: mverab/slashstack-skills
- License: MIT
- Homepage: https://slashstack.dev
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.