Best for
- New or changed HTTP routes, API handlers, or auth flows
- File upload, subprocess, or shell execution
- Environment variable or config changes
Source profileQuality 91/100
johnku2011/boilerplates-with-ai-skills/shared/skills/project-security/SKILL.md
project-security
Use when reviewing security-sensitive code paths — check auth, secrets, input validation, dependency risk, and data exposure before shipping.
- Source repository stars
- 240
- Declared platforms
- 0
- Static risk flags
- 0
- Last source update
- 2026-08-24
- Source checked
- 2026-08-28
Decision brief
What it does: where it fits
Use when reviewing security-sensitive code paths — check auth, secrets, input validation, dependency risk, and data exposure before shipping.
Not for
- Rubber-stamping without checking auth on new endpoints.
- Ignoring client-visible env vars or API responses that expose internals.
Compatibility matrix
Platform support, with evidence labels
| Platform | Status | Evidence | What to check |
|---|---|---|---|
| Codex | Not declared | No explicit evidence | Portability before use |
| Claude Code | Not declared | No explicit evidence | Portability before use |
| Cursor | Not declared | No explicit evidence | Portability before use |
| Gemini CLI | Not declared | No explicit evidence | Portability before use |
Installation
Inspect first. Install second.
The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.
Source-detected install commandSource
npx skills add https://github.com/johnku2011/boilerplates-with-ai-skills --skill "shared/skills/project-security"Safe inspection promptEditorial
Inspect the Agent Skill "project-security" from https://github.com/johnku2011/boilerplates-with-ai-skills/blob/475dc6ac05e1ff29b11e1ae7d443fdabbb75e1e8/shared/skills/project-security/SKILL.md at commit 475dc6ac05e1ff29b11e1ae7d443fdabbb75e1e8. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.
Workflow
What the source asks the agent to do
- 01
Process
1. Map trust boundaries — user input, network, filesystem, subprocesses, third-party APIs, client vs server. 2. Authentication & authorization — every new route/action must declare who can call it and what they can access. 3. Secrets — no keys/tokens in source, logs, client bund…
Map trust boundaries — user input, network, filesystem, subprocesses,Authentication & authorization — every new route/action must declare whoSecrets — no keys/tokens in source, logs, client bundles, or error - 02
When to Use
New or changed HTTP routes, API handlers, or auth flows
New or changed HTTP routes, API handlers, or auth flowsFile upload, subprocess, or shell executionEnvironment variable or config changes - 03
Stack-Specific Checks
When the stack matters, read references/stack-checks.md for web/API and mobile notes (progressive disclosure — load only if needed).
When the stack matters, read references/stack-checks.md for web/API and mobile notes (progressive disclosure — load only if needed). - 04
Severity Guide
Review the “Severity Guide” section in the pinned source before continuing.
Review and apply the “Severity Guide” source section.
Permission review
Static risk signals and limitations
No configured static risk pattern was detected
This is not proof of safety. Runtime behavior, indirect dependencies, and hidden external systems are outside the static scan.
Evidence record
Why each signal appears
EvidenceSourceComputedTestedEditorial
| Signal | Value | Evidence type | Meaning |
|---|---|---|---|
| Quality score | 91/100 | Computed | Documentation, specificity, maintenance, and trust rules |
| Repository stars | 240 | Source | Repository attention, not individual Skill quality |
| Compatibility | 0 platforms | Source | Declared in the catalog source record |
| Usage guide | automated source guide | Editorial | Generated or reviewed according to the visible evidence level |
Pinned source
Provenance and original SKILL.md
- Repository
- johnku2011/boilerplates-with-ai-skills
- Skill path
- shared/skills/project-security/SKILL.md
- Commit
- 475dc6ac05e1ff29b11e1ae7d443fdabbb75e1e8
- License
- MIT
- Collected
- 2026-08-28
- Default branch
- main
View the original SKILL.md
Project Security
Overview
Apply a practical security review to changes in this project. Focus on real exploitable issues, not generic checklists.
Core principle: Assume all external input is hostile. Assume secrets will leak unless kept server-side.
When to Use
- New or changed HTTP routes, API handlers, or auth flows
- File upload, subprocess, or shell execution
- Environment variable or config changes
- Dependency additions or version bumps
- Anything touching user data, tokens, or payments
Process
- Map trust boundaries — user input, network, filesystem, subprocesses, third-party APIs, client vs server.
- Authentication & authorization — every new route/action must declare who can call it and what they can access.
- Secrets — no keys/tokens in source, logs, client bundles, or error responses; env vars on server only.
- Input validation — validate query, body, headers, filenames, and IDs; reject early with safe error messages.
- Output encoding — prevent injection (HTML, SQL, shell, template).
- Dependencies — prefer existing libs; note new supply-chain surface.
- Data exposure — server-only data must not reach client, logs, or analytics.
Stack-Specific Checks
When the stack matters, read references/stack-checks.md
for web/API and mobile notes (progressive disclosure — load only if needed).
Severity Guide
| Severity | Examples |
|---|---|
| Blocking | Missing auth on privileged route, SQL/command injection, secret in client |
| High | Weak session handling, verbose errors leaking internals |
| Medium | Missing rate limit, overly broad CORS |
| Low | Defense-in-depth hardening, logging improvements |
Output Format
## Blocking
- [scenario] Issue — exploit path — fix
## Hardening
- Non-blocking improvements
## Verdict
safe to ship | ship with fixes | do not ship
Anti-patterns
- Rubber-stamping without checking auth on new endpoints.
- Ignoring client-visible env vars or API responses that expose internals.
- Security theater (extra complexity without reduced risk).
- "We will add auth later" on production-bound code.
After Fixes
Re-check the diff. Run bwai scan-project if skills or agent config changed.
Frequently asked questions
What to verify before installation and use
What does the project-security source document cover?
Use when reviewing security-sensitive code paths — check auth, secrets, input validation, dependency risk, and data exposure before shipping.
How do I install project-security?
The source record exposes this install command: npx skills add https://github.com/johnku2011/boilerplates-with-ai-skills --skill "shared/skills/project-security". Inspect the command and pinned source before running it.
Alternatives
Compare before choosing
Computed 10045,960
coreyhaines31/marketingskills
ab-testing
When the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "should I test this," "which version is better," "test two versions," "statistical significance," "how long should I run this test," "growth experiments," "experiment velocity," "experiment backlog," "ICE score," "experimentation program
Computed 10029,236
garrytan/gbrain
bulk-ingestion
End-to-end discipline for turning any large data source (audio libraries, email takeouts, document corpora, chat exports, API dumps) into brain pages at scale. The lifecycle spine: SCHEMA → ACCESS → TRIAL → EVALUATE → IMPROVE → CODIFY → TEST → SKILLIFY → BULK → MONITOR. State is tracked in a durable JSON manifest (see MANIFEST-PATTERN.md) so any crash, session boundary, or subagent fan-out resumes from ground truth instead of memory.
Computed 10025,136
alirezarezvani/claude-skills
app-store-optimization
App Store Optimization (ASO) toolkit for researching keywords, analyzing competitor rankings, generating metadata suggestions, and improving app visibility on Apple App Store and Google Play Store. Use when the user asks about ASO, app store rankings, app metadata, app titles and descriptions, app store listings, app visibility, or mobile app marketing on iOS or Android. Supports keyword research and scoring, competitor keyword analysis, metadata optimization, A/B test planning, launch checklist
Computed 1005,277
dotnet/skills
migrate-vstest-to-mtp
Migrates .NET test projects from VSTest to Microsoft.Testing.Platform (MTP). Use when user asks to "migrate to MTP", "switch from VSTest", "enable Microsoft.Testing.Platform", "use MTP runner", set OutputType=Exe only for test projects in Directory.Build.props, or mentions EnableMSTestRunner, EnableNUnitRunner, or UseMicrosoftTestingPlatformRunner. USE FOR: MTP behavioral differences vs VSTest (exit code 8, zero tests discovered, --ignore-exit-code, TESTINGPLATFORM_EXITCODE_IGNORE); centralizing