Menu
Use when adding authentication, handling user input, working with secrets, creating API endpoints, or modifying security-sensitive code. General security checklist.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | security-review |
| description | Use when adding authentication, handling user input, working with secrets, creating API endpoints, or modifying security-sensitive code. General security checklist. |
| origin | ECC-adapted |
src/api.ts.env (which is gitignored)config.ts, never via process.env directlyFAIL: const key = "sk-abc123..."
PASS: const key = config.ANTHROPIC_API_KEY
FAIL: const id = req.params.id; db.get(id);
PASS: const id = req.params.id; if (!id?.match(/^[a-f0-9]{24}$/)) return res.status(400)...
FAIL: db.prepare(`SELECT * FROM items WHERE id = '${id}'`).get()
PASS: db.prepare('SELECT * FROM items WHERE id = ?').get(id)
esc() helper for all user content rendered in HTMLinnerHTML with unsanitized inputrenderMarkdown() for markdown content (includes sanitization)TRACKER_API_TOKEN)approved_by_class before dispatchesc() or renderMarkdown()eval(), Function(), or child_process.exec() with user inputUse for any question about a codebase, its architecture, file relationships, or project content — especially when graphify-out/ exists, where the question should be treated as a graphify query first. Turns any input (code, docs, papers, images, videos) into a persistent knowledge graph with god nodes, community detection, and query/path/explain tools.
Guide for developing new MCP tools. Use when adding tools to mcp-server.ts or via space plugin mcpTools arrays. Covers Zod validation, actor handling, and test patterns.
Database patterns for better-sqlite3 with WAL mode. Query optimization, schema design, and migration patterns for the tracker's SQLite layer.
Safety guidelines for modifying orchestrator code. Use when touching state transitions, SSE handling, session lifecycle, circuit breaker, safe restart, or dispatch logic in orchestrator.ts.
Research-before-coding workflow. Search for existing patterns, helpers, and implementations in the tracker codebase before writing new code.
Guide for developing new space plugins. Use when creating a new space type or extending an existing one. Covers the SpacePlugin interface, parsers, API routes, MCP tools, and UI renderers.