Agent skill · security · aiskillstore
security-gate
Verify security considerations were addressed before shipping. Issues result in WARNINGS that strongly recommend fixing.
Why this skill is useful
Provides a comprehensive security review checklist and templates for identifying vulnerabilities that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Gate 2: Security Review "Security isn't a feature you add later. It's a foundation you build on." Purpose This gate catches common security vulnerabilities before they reach production. Issues don't BLOCK, but generate strong WARNINGS. Gate Status PASS — No security issues found WARNING — Issues found that should be fixed before production CRITICAL WARNING — Severe issues that really should block --- Gate Questions Question 1: Input Entry Points "Where does user input enter this feature?" Looking for: Awareness of all input sources (forms, URLs, headers, etc.) Understanding that ALL input is untrusted Identification of data flow Follow-up if input exists: "How is that input validated before it's used?" Question 2: Data Access "What data does this feature access? Who should be able to access it?" Looking for: Understanding of data sensitivity Awareness of authorization requirements Knowledge of who can see what Follow-up: "How do you verify the requesting user is allowed to access this data?" Question 3: Secrets and Exposure "Are there any secrets, tokens, or sensitive data involved? Where are they stored?" Looking for: Secrets in environment variables, not code No sensitive data in logs No tokens in URLs or client-side storage (unless necessary) --- Security Checklist Review the code for these common issues: Input Handling [ ] All user input validated server-side [ ] Input length limits enforced [ ] Special characters handled (SQL, HTML, shell) [ ] File uploads validated (type, size, content) Authentication & Authorization [ ] Protected routes require authentication [ ] Users can only access their own data [ ] Admin routes check admin role [ ] Tokens have reasonable expiration Data Exposure [ ] API responses don't include unnecessary fields [ ] Errors don't expose internal details [ ] Logs don't contain passwords/tokens [ ] No sensitive data in URLs Common Vulnerabilities [ ] No SQL string concatenation [ ] No eval() or new Function() with user input [ ] No innerHTM …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/security-gate