ワンクリックでManusで任意のスキルを実行

sec-minimal-trusted-code

スター29

フォーク1

更新日2026年6月12日 07:36

Apply djb's trusted-code minimization when adding features, dependencies, APIs, or config options to wings. Use when designing new packages, public APIs, build steps, or when reviewing a diff that grows the codebase.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

luisfurquim

luisfurquim/wings

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

Minimal Trusted Code (djb)

Source philosophy: D. J. Bernstein, "Some thoughts on security after ten years of qmail 1.0". Security holes are bugs; the bug rate scales with the amount of code that must be correct for security to hold. Three levers, in order of power:

Eliminate code. The most secure line is the one never written. Before adding a feature, ask what it costs in lines-that-must-be-right, not just in lines.
Eliminate bugs in the code that remains. Smaller functions, explicit data flow, no hidden global state, exhaustive handling of every branch.
Eliminate trusted code. Code may exist and still be untrusted: move risky work to where a bug cannot violate security.

How this maps to wings

Build-time vs runtime split is the qmail pattern. gen_i18n does all HTML/flex parsing at build time; the wasm runtime consumes pre-indexed JSON. Keep parsing OUT of the runtime. Any feature that tempts you to parse rich syntax inside the browser belongs in cmd/gen_i18n or cmd/build instead.
Misuse-resistant APIs (NaCl style). One call that is correct by default beats a toolkit of sharp primitives. Existing good examples to imitate: wi18n.SetCatalogPublicKey (one call → all-or-nothing signature enforcement), ApplySkin returning typed errors instead of panicking. A new API should have no "insecure but convenient" mode.
Dependencies are trusted code you didn't write. go.mod currently has 6 direct requires. Every candidate dep must answer: what does it replace, how many transitive deps does it drag in (go mod graph), could 50 lines of our own code do it? (See sec-supply-chain.)
Config options multiply states. Every WINGS_* env var or wings.json key doubles the test matrix. Prefer one good default over a knob.

Checklist for a new feature/API

Could this live at build time instead of runtime?
Is there a single entry point that is safe by default (no flag that disables verification, escaping, or validation)?
Does the public surface return error instead of panicking (input validation contract of this repo)?
Net lines of security-relevant code: did it shrink or grow? If it grew, is the growth isolated in one package with a narrow interface?
Zero new dependencies, or a written justification.

Anti-patterns

"Flexible" template/expression features evaluated at runtime from user-supplied strings.
Helper that accepts interface{}/js.Value and "figures it out" — that is a parser in disguise; type it at the boundary.
Duplicating validation in N call sites instead of funneling through one choke point (one validator = one place to audit).

このリポジトリの他の Skills

同じリポジトリ

wings-widgets

luisfurquim/wings

Use WINGS's built-in widgets instead of hand-rolling them — button (w-button), text input (w-input), rich-text editor (w-text), tabbed containers (w-tabs/w-tabbutton/w-tab), dialogs (w-dialog), multi-select combobox (w-combobox), record navbar (w-navbar), and the skin picker (skin-switcher). Use when an app needs any of these controls.

2026-07-1429

sec-wasm-go

luisfurquim/wings

Security peculiarities of Go-to-WASM in the browser, for apps you build with WINGS — the syscall/js trust boundary, panic = whole-app death, the innerHTML/XSS invariant, secrets in browser memory, single-thread concurrency, GOOS=js tooling gaps. Use when writing or reviewing any component (GOOS=js code), DOM interop via syscall/js, fetch, or browser-delivered features in your app.

2026-07-0429

wings-component

luisfurquim/wings

Write a WINGS component (custom element in Go→WASM) — module file trio, wings.Register, the PranaMod lifecycle (InitData/Render), template binding syntax ({{expr}}, ?cond, *arr/**arr, &attr, @event), and parent-child events. Use when creating or editing a WINGS module, template, custom element, PranaMod, or any template binding.

2026-07-0429

wings-i18n

luisfurquim/wings

Internationalize a WINGS app — author plain text that the gen_i18n build step extracts into per-language catalogs, runtime lookup via wi18n, translatable attributes, opting out, plurals/gender flexion ({{@g %n ~word}}), locale-aware formatting ({{%price}}), and runtime locale switching (SetLang). Use when adding translatable text, plurals/gender, number/currency/date formatting, or a language switcher.

2026-07-0429

wings-skins

luisfurquim/wings

Theme a WINGS app with --wings-* skin tokens — consume tokens in component CSS via var() with fallbacks, apply/compose built-in skins (ApplySkin), the ten disjoint skin categories and multi-skin composition, register your own skin, bundles (composed skins), and private categories. Use when styling components to be theme-aware, applying or composing skins, or building a theme.

2026-07-0429

sec-fail-operational

luisfurquim/wings

Apollo AGC fail-operational design (priority shedding, bounded everything, restart protection, NASA Power of 10) applied to YOUR WINGS app — loops, goroutines, timers, fetch error paths, recovery. Use when writing component effects, background goroutines, polling/retry, or any code that must keep the app rendering when one part fails.

2026-06-1329

Minimal Trusted Code (djb)

Eliminate code. The most secure line is the one never written. Before adding a feature, ask what it costs in lines-that-must-be-right, not just in lines.

Eliminate bugs in the code that remains. Smaller functions, explicit data flow, no hidden global state, exhaustive handling of every branch.

Eliminate trusted code. Code may exist and still be untrusted: move risky work to where a bug cannot violate security.

How this maps to wings

Build-time vs runtime split is the qmail pattern. gen_i18n does all HTML/flex parsing at build time; the wasm runtime consumes pre-indexed JSON. Keep parsing OUT of the runtime. Any feature that tempts you to parse rich syntax inside the browser belongs in cmd/gen_i18n or cmd/build instead.

Misuse-resistant APIs (NaCl style). One call that is correct by default beats a toolkit of sharp primitives. Existing good examples to imitate: wi18n.SetCatalogPublicKey (one call → all-or-nothing signature enforcement), ApplySkin returning typed errors instead of panicking. A new API should have no "insecure but convenient" mode.

Dependencies are trusted code you didn't write. go.mod currently has 6 direct requires. Every candidate dep must answer: what does it replace, how many transitive deps does it drag in (go mod graph), could 50 lines of our own code do it? (See sec-supply-chain.)

Config options multiply states. Every WINGS_* env var or wings.json key doubles the test matrix. Prefer one good default over a knob.

Checklist for a new feature/API

Could this live at build time instead of runtime?

Is there a single entry point that is safe by default (no flag that disables verification, escaping, or validation)?

Does the public surface return error instead of panicking (input validation contract of this repo)?

Net lines of security-relevant code: did it shrink or grow? If it grew, is the growth isolated in one package with a narrow interface?

Zero new dependencies, or a written justification.

Anti-patterns

"Flexible" template/expression features evaluated at runtime from user-supplied strings.

Helper that accepts interface{}/js.Value and "figures it out" — that is a parser in disguise; type it at the boundary.

Duplicating validation in N call sites instead of funneling through one choke point (one validator = one place to audit).

name	sec-minimal-trusted-code
description	Apply djb's trusted-code minimization when adding features, dependencies, APIs, or config options to wings. Use when designing new packages, public APIs, build steps, or when reviewing a diff that grows the codebase.