Agent skill · luongnv89
security-setup
Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI. Use when hardening repos or adding security hooks. Don't use for incident response or cloud security reviews.
What it needs
About 8k tokens when loaded.
What this skill does
Security Setup Install a local-first security hardening stack for a project. Favor checks that run offline at hook time, produce machine-readable output, and give developers a clear summary before code leaves their machine. Keep the orchestrator short for the agent's context budget: detailed matrices, templates, and long verification scenarios live in references/. Link, don't inline. This skill may trigger automatically per its description, but it never writes silently: Phase 1 always dry-runs the planned changes and waits for explicit user confirmation before touching files, and Phase 2 (CI) only runs when the user explicitly asks for it (e.g. --ci). Prerequisites Git repo with a branch you can commit to. Python 3.8+ and pip. Permission to create .pre-commit-config.yaml, scripts/, security/, SECURITY.md. (Optional for --ci) GitHub Actions enabled on the repo. Network for initial tool/db installs (subsequent hook runs are offline). Confirm these before Phase 1. If a tool cannot be made offline, document the gap instead of pretending. Repo Sync Before Edits (mandatory) Before creating/updating/deleting files in an existing repository, sync the current branch with remote: If the working tree is not clean, stash first as a backup, sync, then restore: If origin is missing, pull is unavailable, or rebase/stash conflicts occur, stop and ask the user before continuing. Never use --force rollback options without confirmation. Operating Model Work in two gated phases: 1. Local security baseline - install a pre-commit hook that checks secrets, dependency vulnerabilities, and static analysis issues locally. 2. CI/CD mirror - only when the user asks for --ci, create a free-tier GitHub Actions workflow that runs the same local runner on pull requests. Do not create CI files until Phase 1 is installed and passing. Phase 1 - Local Security Baseline 1. Detect the Project Inspect the repo before choosing tools. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills luongnv89/security-setup