security-engineering

Stars13

Forks3

UpdatedJuly 16, 2026 at 17:16

Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

LazyIsEfficient

LazyIsEfficient/agentic-os

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

11 files

SKILL.md

readonly

name	security-engineering
description	Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).
when_to_use	Use for cross-stack security review covering API security, infrastructure hardening, Web3 smart contract auditing, CI/CD pipeline security (OIDC, supply chain), and agentic AI risk (OWASP ASI 2026). Load when a diff touches auth, sessions, crypto, smart contracts, CI/CD secrets, or any user-input-to-sensitive- sink path. Not when: the task is scanning files for committed PII — use [security](../security/SKILL.md). Not when the task is a general multi-axis code review (correctness, readability, architecture, performance) rather than application security engineering — use [code-review-and-quality](../code-review-and-quality/SKILL.md).
compatibility	Requires Bash (Python 3 where scripts are invoked). Works in Claude Code and Codex via install.sh.

Security Engineering

Cross-stack security rules covering API security, infrastructure hardening, Web3 smart contracts, CI/CD review automation, and agentic AI risks. Aligned to OWASP Top 10:2025, ASVS 5.0, and OWASP Agentic Security Initiative 2026.

When reviewing code, think like a senior security researcher: trace user input through to sensitive operations, prefer fail-closed designs, and never trust the client.

Universal Rules

Validate every input server-side with Zod (or equivalent) at the API boundary.
Parameterize all queries — Prisma/Drizzle, never string concatenation.
Authorize on every request — deny by default, verify ownership.
Hash passwords with Argon2 or bcrypt — never MD5/SHA1, never plaintext.
No hardcoded secrets — env vars validated at startup, secrets in vault, .env in .gitignore.
TLS everywhere, encryption at rest on all data stores.
Fail-closed on auth/permission errors. Never expose stack traces to users.
Log security events with sanitization — redact authorization, cookie, CSRF headers.
Least-privilege IAM — scope to specific actions and resource ARNs, not *.
OIDC for CI/CD — no long-lived credentials in GitHub.
Smart contracts: ReentrancyGuard, SafeERC20, signed data must include chainid + address(this) + deadline, replay-prevention via usedHashes.

References

references/owasp-top-10.md — OWASP Top 10:2025 quick reference table
references/cicd-security.md — CI/CD security review methodology, scanned vulnerability categories, supply-chain check
references/api-security.md — auth patterns, Zod validation, rate limiting, CORS, headers, log sanitization, error handling
references/infrastructure-security.md — VPC isolation, Cloudflare Zero Trust, secrets management, encryption, IAM principles
references/web3-smart-contracts.md — required patterns, signature verification, on-chain rate limits, audit findings, Slither
references/code-review-checklist.md — full checklist by category (input, auth, access control, data, errors, Web3)
references/secure-code-patterns.md — SQLi, command injection, access control, fail-closed, password storage examples
references/agentic-ai-security.md — OWASP 2026 ASI01-10 + agent security checklist
references/asvs-5.md — L1/L2/L3 requirements
references/language-specific.md — JS/TS, Solidity, Python, Go, Bash risks + deep analysis mindset

Related skills

web3-smart-contract-engineering — Solidity patterns, signature verification, replay protection (consult alongside references/web3-smart-contracts.md when auditing contracts)
deployment-pipelines — pipeline hardening, OIDC, untrusted-input handling in CI
godot-engineer — multiplayer games have real security concerns: cheating, save tampering, server-side validation, anti-replay. Pull this in for any networked game.

More from this repository

same repository

adversarial-claims-reviewer

LazyIsEfficient/agentic-os

Use when adversarially reviewing a document that makes formal or technical claims — math derivations, physics papers, statistical analyses, benchmark reports, whitepapers. Inventories every equation and quantitative claim, verifies each AS NAMED in the text (never a paraphrase or a neighboring statement), and classifies VERIFIED / REFUTED / UNVERIFIABLE / VACUOUS. Triggers on "check this paper", "verify these claims", "is this derivation right", "review this proof", "audit this benchmark", "does the math hold up". For source-code review see code-review-and-quality; for skill/agent library audits see skill-library-review; for content quality scoring see content-ops.

2026-07-1613

autoresearch

LazyIsEfficient/agentic-os

Run Karpathy-style autoresearch optimization on any content. Generates 50+ variants, scores with a 5-expert simulated panel, evolves winners through multiple rounds, outputs optimized version + full experiment log. Use when optimizing landing pages, email sequences, ad copy, headlines, form pages, CTA text, or any conversion-focused content. Triggers on "optimize this page", "run autoresearch", "score these variants", "A/B test this copy".

2026-07-1613

browser-testing-with-devtools

LazyIsEfficient/agentic-os

Tests in real browsers. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data via Chrome DevTools MCP.

2026-07-1613

code-review-and-quality

LazyIsEfficient/agentic-os

Conducts multi-axis code review across correctness, readability, architecture, security, and performance. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Triggers on "review my PR", "review this diff", "code review", "review this changeset", "is this ready to merge", "pre-merge review".

2026-07-1613

codebase-cost-estimator

LazyIsEfficient/agentic-os

Estimate the full development cost of an existing codebase from lines of code, architectural complexity, and team-composition overhead. Use for 'how much would this cost to build', 'what did this codebase cost', development-cost or build-cost estimates, calendar-time estimates, and Claude/AI ROI on a delivered codebase. Estimates by measured LOC and complexity, not by ticket volume.

2026-07-1613

content-ops

LazyIsEfficient/agentic-os

Auto-assembles a domain-specific expert panel (7–10 experts), scores any content or strategy artifact against a typed rubric, and iterates until the aggregate hits 90+ (max 3 rounds). Use as a quality gate on copy, email sequences, landing-page drafts, strategy docs, charts, titles, or recruiting evaluations — or when another skill needs a final review gate on its output. Triggers on "expert panel this", "score this", "rate these variants", "quality check this", "panel review", "expert score", "evaluate this copy/strategy/page". For variant generation and multi-round conversion optimization see autoresearch; for live-URL CRO auditing see conversion-ops; for the scripted content-production pipeline see content-pipeline.

2026-07-1613

name	security-engineering
description	Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).
when_to_use	Use for cross-stack security review covering API security, infrastructure hardening, Web3 smart contract auditing, CI/CD pipeline security (OIDC, supply chain), and agentic AI risk (OWASP ASI 2026). Load when a diff touches auth, sessions, crypto, smart contracts, CI/CD secrets, or any user-input-to-sensitive- sink path. Not when: the task is scanning files for committed PII — use [security](../security/SKILL.md). Not when the task is a general multi-axis code review (correctness, readability, architecture, performance) rather than application security engineering — use [code-review-and-quality](../code-review-and-quality/SKILL.md).
compatibility	Requires Bash (Python 3 where scripts are invoked). Works in Claude Code and Codex via install.sh.

Security Engineering

When reviewing code, think like a senior security researcher: trace user input through to sensitive operations, prefer fail-closed designs, and never trust the client.

Universal Rules

Validate every input server-side with Zod (or equivalent) at the API boundary.
Parameterize all queries — Prisma/Drizzle, never string concatenation.
Authorize on every request — deny by default, verify ownership.
Hash passwords with Argon2 or bcrypt — never MD5/SHA1, never plaintext.
No hardcoded secrets — env vars validated at startup, secrets in vault, .env in .gitignore.
TLS everywhere, encryption at rest on all data stores.
Fail-closed on auth/permission errors. Never expose stack traces to users.
Log security events with sanitization — redact authorization, cookie, CSRF headers.
Least-privilege IAM — scope to specific actions and resource ARNs, not *.
OIDC for CI/CD — no long-lived credentials in GitHub.
Smart contracts: ReentrancyGuard, SafeERC20, signed data must include chainid + address(this) + deadline, replay-prevention via usedHashes.

References

references/owasp-top-10.md — OWASP Top 10:2025 quick reference table
references/cicd-security.md — CI/CD security review methodology, scanned vulnerability categories, supply-chain check
references/api-security.md — auth patterns, Zod validation, rate limiting, CORS, headers, log sanitization, error handling
references/infrastructure-security.md — VPC isolation, Cloudflare Zero Trust, secrets management, encryption, IAM principles
references/web3-smart-contracts.md — required patterns, signature verification, on-chain rate limits, audit findings, Slither
references/code-review-checklist.md — full checklist by category (input, auth, access control, data, errors, Web3)
references/secure-code-patterns.md — SQLi, command injection, access control, fail-closed, password storage examples
references/agentic-ai-security.md — OWASP 2026 ASI01-10 + agent security checklist
references/asvs-5.md — L1/L2/L3 requirements
references/language-specific.md — JS/TS, Solidity, Python, Go, Bash risks + deep analysis mindset

Related skills

web3-smart-contract-engineering — Solidity patterns, signature verification, replay protection (consult alongside references/web3-smart-contracts.md when auditing contracts)
deployment-pipelines — pipeline hardening, OIDC, untrusted-input handling in CI
godot-engineer — multiplayer games have real security concerns: cheating, save tampering, server-side validation, anti-replay. Pull this in for any networked game.