메뉴
Security practices: secrets in env vars, input validation, SSRF prevention, error sanitization, and production hardening. Use when handling authentication, secrets, user input, or preparing production deployments.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | security-practices |
| description | Security practices: secrets in env vars, input validation, SSRF prevention, error sanitization, and production hardening. Use when handling authentication, secrets, user input, or preparing production deployments. |
"I'll use --allow-all for convenience" No. Only broad permissions in test files and scripts, never production.
"I'll hardcode the API key for now" No. All secrets go in environment variables. No exceptions.
"I'll skip the pre-commit hook this once"
No. Never bypass hooks with --no-verify.
See rules.md for complete conventions.
JavaScript/TypeScript conventions: ES modules, Deno runtime, React patterns, async/await, and type handling. Use when writing .ts, .tsx, or .js files, configuring imports, or building React components.
Development tooling: Deno runtime, JSR package registry, deno.json and package.json configuration, and editor settings. Use when setting up projects, choosing packages, or configuring build tools.
Agent roles, safety rules, file ownership, and cross-package change protocol. Use when AI agents work on this codebase, plan multi-package changes, or need boundary guidance.
System architecture: ES modules, hexagonal architecture, project structure, ADRs, and testing strategy. Use when designing systems, planning directory layout, writing ADRs, or reviewing architecture.
CI/CD operations: GitHub Actions, Kubernetes, ArgoCD, and CI timeout configuration. Use when configuring pipelines, debugging deployments, or working with GitHub Actions. Do NOT use for general development workflow.
Code quality: error handling, validation, logging, DRY, and self-documenting code. Use when writing or reviewing code quality, handling errors, or validating inputs. Do NOT use for language-specific syntax (use javascript-practices or go-practices).
