# Security

> Use before deploy or sharing to check for beginner-visible security risks.

- **Type:** Skill
- **Install:** `agentstack add skill-mverab-slashstack-skills-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [mverab](https://agentstack.voostack.com/s/mverab)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [mverab](https://github.com/mverab)
- **Source:** https://github.com/mverab/slashstack-skills/tree/main/skills/security
- **Website:** https://slashstack.dev

## Install

```sh
agentstack add skill-mverab-slashstack-skills-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security

## Purpose

Run a beginner-friendly pre-deploy safety review for common security risks.

## When to Use

Use before deploy, sharing a repo, adding auth, connecting payments, exposing an
API, or asking an agent to make production-facing changes.

## Workflow

1. Inspect secrets: check for committed `.env` files, API keys, tokens,
   credentials, private URLs, and hardcoded secrets.
2. Check auth assumptions: identify pages, API routes, admin screens, and data
   mutations that appear to rely on weak or missing auth.
3. Review public routes: list routes, endpoints, storage buckets, or files that
   could be publicly reachable.
4. Check risky defaults: flag debug mode, permissive CORS, open redirects,
   client-side secret usage, broad database rules, or unsafe sample config.
5. Explain severity in plain language: High means do not deploy; Medium means
   fix before real users; Low means track or clean up soon.
6. Suggest safe fixes: provide concrete next prompts or commands without
   applying changes automatically.
7. Modo Aprendiz: for EACH security risk, include three sub-fields in
   beginner-friendly Spanish:
   - Qué significa: what the risk means in plain language.
   - Por qué importa: why it matters for the project.
   - Qué hacer ahora: one concrete action to take now.

## Output

A security review containing:
- High risks: secrets, auth, or public routes that block deploy
- Medium risks: likely unsafe defaults or missing checks
- Low risks: cleanup items
- Modo Aprendiz: each risk includes Qué significa, Por qué importa, and Qué hacer ahora
- Safe next prompt: one scoped prompt to fix the highest-risk item first

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [mverab](https://github.com/mverab)
- **Source:** [mverab/slashstack-skills](https://github.com/mverab/slashstack-skills)
- **License:** MIT
- **Homepage:** https://slashstack.dev

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-mverab-slashstack-skills-security
- Seller: https://agentstack.voostack.com/s/mverab
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.