ShieldNet-360
OrganizationSecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.
Categories
Indexed Skills (31)
api-security
Apply OWASP API Top 10 patterns to authentication, authorization, and input validation — Applies to: when generating HTTP handlers; when generating GraphQL resolvers; when generating gRPC service methods; when reviewing API endpoint changes
auth-security
JWT, OAuth 2.0 / OIDC, session management, CSRF, password hashing, and MFA enforcement — Applies to: when generating login / signup / password-reset flows; when generating JWT issuance or verification; when generating OAuth 2.0 / OIDC client or server code; when wiring session cookies, CSRF tokens, MFA
cicd-security
Harden GitHub Actions, GitLab CI, and similar pipelines against supply-chain attacks, secret exfiltration, and pwn-request style abuses — Applies to: when authoring or reviewing CI/CD workflow files; when adding a third-party action / image / script to a pipeline; when wiring cloud or registry credentials into CI; when triaging a suspected pipeline compromise
container-security
Hardening rules for Dockerfile, OCI images, Kubernetes manifests, and Helm charts — Applies to: when generating a Dockerfile or OCI image build; when generating Kubernetes / Helm / Kustomize manifests; when reviewing container changes in PR
cors-security
Strict CORS configuration: no wildcard with credentials, allowlist-based origins, sensible preflight cache, minimal exposed headers — Applies to: when generating CORS middleware or framework config; when wiring API Gateway / Cloud Front / Nginx CORS headers; when reviewing a cross-origin browser-facing endpoint
crypto-misuse
Block weak ciphers, predictable RNG, undersized keys, slow-hash misuse, and non-constant-time comparisons — Applies to: when generating code that hashes / encrypts / signs; when generating code that compares secrets / MACs / tokens; when wiring TLS settings, key sizes, or RNG
database-security
Prevent SQL injection, ORM misuse, credential leaks; enforce least-privilege DB users and safe migrations — Applies to: when generating SQL or raw query strings; when generating ORM model code or queries; when generating database migration files; when wiring connection strings or pooling
dependency-audit
Audit project dependencies for known vulnerabilities, malicious packages, and supply chain risks — Applies to: when adding a new dependency; when upgrading dependencies; when reviewing package manifests (package.json, requirements.txt, go.mod, Cargo.toml); before merging a PR that modifies dependency files
deserialization-security
Block unsafe deserialization across Java, Python, .NET, PHP, Ruby, Node.js — gadget chains, type allowlisting, safer alternatives — Applies to: when generating code that deserializes data from any untrusted source; when wiring cookies, sessions, message queues, or RPC payloads; when reviewing pickle / unserialize / Marshal / ObjectInputStream / BinaryFormatter usage
dynamic-verification
Confirm or refute a vulnerability candidate against a live target with a deterministic probe (the agent runs the probe, respecting authorization and scope) — Applies to: when a static/SAST or LLM review flags a possible injection or SSRF; when triaging a finding before opening a bug or shipping a fix; when an authorized dynamic test against a running app is available; when a verification result turns out wrong and the PoC or skill needs fixing
electron-security
Harden Electron apps: renderer trust boundary (nodeIntegration, contextIsolation, sandbox), contextBridge/IPC allowlists, shell.openExternal, navigation guards, deep-link auth, safeStorage — Applies to: when generating Electron main-process code (BrowserWindow, ipcMain, app events); when generating a preload script or contextBridge surface; when wiring custom-protocol / deep-link handlers; when storing tokens or secrets in an Electron app; when reviewing Electron IPC, navigation, or window configuration
error-handling-security
No stack traces / SQL / paths / framework versions in client responses; generic errors out, structured errors in logs — Applies to: when generating HTTP / GraphQL / RPC error handlers; when generating exception / panic / rescue blocks; when wiring framework default error pages
file-upload-security
Validate user uploads: MIME magic bytes, filename sanitization, size limits, separate serving domain, AV scanning, polyglot detection — Applies to: when generating an HTTP file-upload endpoint; when wiring presigned-URL upload to S3 / GCS / Azure Blob; when adding image/PDF/document processing of user uploads; when reviewing user-generated-content storage and serving
frontend-security
Browser-side hardening: XSS, CSP, CORS, SRI, DOM clobbering, iframe sandboxing, Trusted Types — Applies to: when generating HTML / JSX / Vue / Svelte templates; when wiring up response headers in a web app; when adding third-party script tags or CDN resources
graphql-security
Defend GraphQL APIs: depth/complexity limits, introspection in production, batching/aliasing abuse, field-level authorization, persisted queries — Applies to: when generating GraphQL schemas, resolvers, or server config; when wiring authentication/authorization to a GraphQL endpoint; when adding a public GraphQL API gateway; when reviewing /graphql endpoint exposure
iac-security
Hardening rules for Terraform, CloudFormation, and Pulumi: state, providers, drift, secrets — Applies to: when generating Terraform / Pulumi / CloudFormation; when reviewing IaC changes in PR; when wiring up a new cloud account or workspace
iam-best-practices
Least-privilege IAM design, key rotation, MFA enforcement, role assumption, and cross-account access patterns for AWS / GCP / Azure / Kubernetes — Applies to: when generating IAM policies, roles, or trust documents; when wiring CI/CD service accounts or workload identities; when reviewing access-key creation, rotation, or revocation; when designing cross-account or cross-tenant access
llm-app-security
Securing an app feature that calls an LLM with prompts: prompt injection (direct & indirect), prompt-construction boundaries, RAG context segregation, output handling, system-prompt & secret leakage, tool allowlists, cost limits — Applies to: when generating code that sends a prompt to an LLM API; when building a RAG pipeline or feeding retrieved / tool content back into a prompt; when rendering or executing LLM output (UI, SQL, shell, file, HTTP); when exposing an LLM-backed endpoint to users
logging-security
Prevent secret/PII leaks in logs, log-injection attacks, missing audit trails, weak retention — Applies to: when generating logger calls or structured-logging schemas; when wiring log shippers, sinks, retention, and access controls; when reviewing requirements for audit logging
ml-security
Model artifact loading (pickle vs safetensors), model & data poisoning, PII in training data, secrets in notebooks, model provenance / lineage — Applies to: when generating code that loads ML models from disk / Hub / S3; when generating data pipelines that ingest user content for training / fine-tuning; when generating ML notebooks or training / evaluation scripts
mobile-security
Android and iOS hardening: exported components, ATS, keychain, certificate pinning, root/jailbreak detection — Applies to: when generating Android (Kotlin / Java) app code or manifests; when generating iOS (Swift / Objective-C) app code; when generating React Native / Flutter native modules
protocol-security
TLS 1.2+, mTLS, certificate validation, HSTS, gRPC channel credentials, WebSocket origin checks — Applies to: when generating HTTP / gRPC / WebSocket / SMTP / database clients & servers; when generating TLS configuration in code or platform config; when generating service-to-service auth
saas-security
Detect tokens, misconfigurations, and admin red flags for major SaaS platforms (GWS, Atlassian, Notion, HubSpot, Salesforce, BambooHR, Workday, Odoo, chat platforms, Zoom, Calendly, NetSuite) — Applies to: when wiring a SaaS API key or OAuth token into code; when reviewing a SaaS connector / webhook / SCIM bridge; when triaging suspicious SaaS admin activity; when authoring infrastructure that proxies SaaS traffic; when answering a SaaS-related security question
secret-detection
Detect and prevent hardcoded secrets, API keys, tokens, and credentials in code — Applies to: before every commit; when reviewing code that handles credentials; when writing configuration files; when creating .env or config templates
secure-code-review
Apply OWASP Top 10 and CWE Top 25 patterns during code generation and review — Applies to: when generating new code; when reviewing pull requests; when refactoring security-sensitive paths (auth, input handling, file I/O); when adding new HTTP handlers or endpoints
security-regression-tests
Lock every confirmed security fix with a deterministic regression test so CI re-verifies it on every build (no live probing) — Applies to: when a security finding has been confirmed and fixed; when generating or changing security-sensitive code (authz, input handling, secrets); when wiring a security gate into CI/CD
serverless-security
Lambda / Cloud Functions / Azure Functions hardening: IAM, timeouts, secrets, event injection — Applies to: when generating AWS Lambda / GCP Cloud Functions / Azure Functions code; when generating serverless.yml / SAM templates / functions framework; when wiring API Gateway, EventBridge, SQS, S3 triggers
ssrf-prevention
Defend against Server-Side Request Forgery: cloud metadata blocking, internal IP filtering, DNS rebinding defense, allowlist-based URL fetching — Applies to: when generating code that fetches a URL supplied by the client; when wiring webhooks, image proxies, PDF renderers, oEmbed fetchers; when running in any cloud environment with an instance metadata service; when reviewing a URL-parsing or HTTP-client wrapper
template-injection
Prevent server-side template injection — user input reaching a template compiler, double-render pipelines, sandbox escapes, and template-driven resource exhaustion — Applies to: when rendering templates with any user-influenced value (email / notification bodies, PDFs, HTML, config); when a template's source string is assembled or stored from user input; when using a template engine (Jinja2, Twig, Freemarker, Velocity, ERB, Handlebars, Go text/html-template, Thymeleaf, Razor, Liquid, Mako, Pug); when reviewing a two-step render / re-parse pipeline
threat-modeling
Review a design or architecture for security flaws — trust boundaries, authorization, data flow, and attack surface — before code is written — Applies to: when scaffolding a new feature, service, or endpoint; when writing or reviewing a design doc / RFC / ADR; when introducing a new trust boundary, integration, or data flow; when reviewing an architecture or module at the design level
websocket-security
Secure WebSocket endpoints: Origin validation, auth on handshake, message size/rate limits, wss-only, reconnection backoff — Applies to: when generating a WebSocket / Socket.IO / SignalR server; when wiring real-time messaging, presence, or collaborative editing; when reviewing /ws or wss:// endpoint exposure
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.